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PREFACE 


V 

In  1981,  -fhe  Marine  Board  of  the  National  Research  Council  completed  a 
comprehensive  assessment  of  the  safety  of  the  technologies  and  regu¬ 
lations  pertaining  to  outer  continental  shelf  (OCS^oil  and  gas 
development.  An  important  area  of  study  was  safety  information 
because  without  a  strong  safety  information  component  in  the  OCS 
regulatory  program,  it  is  not  readily  possible  for  the  government  to 
identify  safety  problems  and  courses  of  action^ National  Research 
Council,  1981) i"i>In  response  to  this  concern,  the  Minerals  Management 
Service  (MMS)  requested  in  June  1982  that  the  Marine  Board  provide  an 
analysis  of  OCS  safety  information  systems,  including  the  types  of 
information  to  be  collected,  analytical  processes  for  utilizing  data, 
and  techniques  for  maximizing  compatibility  with  other  information 
systems . 

The  Commission  on  Engineering  and  Technical  Systems  of  the 
National  Research  Council  convened  the  Committee  on  OCS  Safety 
Information  and  Analysis  under  its  Marine  Board.  Members  of  the 
committee  were  selected  for  their  experience  in  risk  analysis,  system 
safety,  marine  industrial  safety,  OCS  industrial  safety  programs,  OCS 
regulations  and  industrial  compliance  strategies,  protection  of  the 
cirine  environment,  and  the  environment  of  the  heavy  industrial  work¬ 
place.  Consistent  with  the  policies  and  procedures  of  the  National 
Research  Council,  obtaining  an  appropriate  balance  of  perspectives  was 
an  important  consideration  in  choosing  committee  members. 


SCOPE  OF  STUDY 

The  charge  to  the  committee  was  to  recommend  an  approach  to  safety 
information  acquisition,  analysis,  and  utilization  that  meets  manage¬ 
ment  needs.  The  committee  was  to  review  the  safety  management  systems 


♦The  OCS  is  that  portion  of  the  submerged  continental  margin  that  is 
subject  to  U.S.  jurisdiction.  For  the  purpose  of  this  report,  the  OCS 
extends  from  a  state's  offshore  boundary  (3  miles  offshore  except  off 
Texas  and  west  Florida  where  state  boundaries  extend  3  leagues  —  9 
nautical  miles — offshore)  out  to  the  limit  of  economic  exploitation. 


of  the  MMS  to  provide  the  background  and  framework  for  its 
recommendations.  The  committee  also  was  instructed  to  identify  the 
essential  elements  of  safety  management,  to  review  the  safety 
management  activities  of  the  MMS,  and  to  assess  the  role  and  use  of 
safety  information  in  the  MMS. 

The  committee  concentrated  its  assessment  on  areas  where 
improvements  in  safety  information  or  information  management  practices 
could  lead  to  improvements  in  OCS  safety  management  by  industry,  or 
government,  or  both.  The  committee  was  not  to  identify  safety 
problems,  but  to  focus  instead  on  the  definition  and  assessment,  and 
development  and  management  of  information  systems  to  meet  management 
needs.  In  this  regard,  the  committee  considers  the  National  Research 
Council's  1981  report.  Safety  and  Offshore  Oil,  to  be  a  comprehensive 
review  of  OCS  safety.  The  assessments  and  findings  in  Safety  and 
Offshore  Oil  that  are  within  the  scope  of  the  current  committee  are 
hereby  incorporated  by  reference. 


The  scope  of  the  committee's  activity  was  set  by  the  scope  of  the 
Minerals  Management  Service's  interests,  which  are  concentrated  on  OCS 
oil  and  gas  drilling  and  production,  and  some  aspects  of  pipelines. 
These  activities  do  not  represent  the  entire  spectrum  of  OCS  activity, 
which  includes  aircraft  and  boat  operations.  This  limitation  has 
certain  other  implications:  the  full  range  of  OCS  safety  interests, 
e.g.,  health,  are  not  included;  the  OCS  safety  management  and  infor¬ 
mation  activities  of  other  agencies,  i.e.,  Coast  Guard,  Environmental 
Protection  Agency,  and  Occupational  Safety  and  Health  Administration, 
are  examined  solely  from  the  standpoint  of  their  interface  with  the 
MMS. 


The  committee  defined  certain  terms  at  the  outset.  Safety 
comprises  the  safety  of  workers,  the  environment,  and  of  equipment  and 
structures.  Management  systems  refers  to  the  organization  of  decision¬ 
making.  Information  systems  refers  to  data  collection  and  development, 
its  maintenance  in  data  bases,  and  its  analysis.  Safety  information 
consists  of  data  reports,  analyses,  and  statistics  concerning  unplanned 
or  unexpected  incidents  relating  to  environmental  damage,  bodily 
injury  or  death,  or  property  damage. 


CONDUCT  OF  STUDY 

The  committee  reviewed  a  variety  of  background  materials.  This 
included:  comprehensive  reviews  of  OCS  safety  (National  Research 
Council,  1981),  studies  of  safety  in  the  nuclear  power  industry 
(Miller,  1980),  an  analysis  of  the  costs  and  benefits  of  Minerals 
Management  Service  regulations  (Arthur  D.  Little,  Inc.,  1982), 
treatises  on  industrial  and  system  safety,  and  descriptions  of  major 
corporate  safety  systems  (see  Appendix  D),  all  to  identify  the 
elements  normally  considered  important  in  safety  systems. 


vi 


The  program*,  file*,  and  data  bases  of  the  MMS  were  reviewed  to 
identify  those  that  relate  to  safety  management.  The  adequacy  of  this 
subset  was  then  assessed  in  terms  of  the  essential  elements  of  safety 
management  identified  by  the  committee.  The  committee  also  conferred 
with  officials  of  the  MMS,  Coast  Guard,  Occupational  Safety  and  Health 
Administration,  and  Environmental  Protection  Agency  regarding  the 
status  of  OCS  safety  management  and  information  systems. 

The  committee  visited  an  OCS  drilling  operation  and  a  production 
operation,  together  with  MMS  inspectors  who  conducted  mock  inspections. 
A  meeting  convened  at  the  Gulf  of  Mexico  regional  headquarters  of  the 
MMS  provided  an  opportunity  to  review  regulatory  procedures  and  com¬ 
pliance  methods  with  agency  staff.  Also  at  this  meeting,  the  committee 
received  a  presentation  on  the  industrial  saf^t”  program  of  one  of  the 
OCS  operating  companies  (see  Appendix  D). 

The  committee’s  conclusions  and  recommendations  are  provided  in 
the  summary  chapter.  They  are  based  on  committee  activities  and  the 
professional  experience  of  committee  members. 


i 

i 

I 


CONTENTS 


Page 


1.  Summary,  Conclusions,  and  Recommendations  1 

2.  The  Government's  Role  on  the  Outer  Continental  Shelf  7 

and  How  it  Affects  the  Acquisition  of  Safety  Information 

Respective  Roles  of  Government  and  Industry  9 

3.  Outer  Continental  Shelf  Safety  Information  11 

Status  of  Outer  Continental  Shelf  Safety  Data  11 

Assessment  of  Usefulness  of  Existing  Safety  Data  27 

4.  System-Level  Assessment  of  the  Minerals  Management  31 

Service  Safety  Management  Program 

Alternate  Modes  of  Safety  Program  Implementation  31 

Factors  to  Consider  When  Setting  Goals  35 

Opportunities  Afforded  by  Monitoring  Safety  P  rformance  35 
The  Importance  of  Analyzing,  Interpreting,  a  i  38 

Disseminating  Safety  Information 
Assessment  39 

Appendix  A:  Elements  of  Safety  Management  Systems  43 

Appendix  B:  Description  and  Assessment  of  the  Minerals  61 

Management  Service  Safety  Program  Components 

Appendix  C:  Sumnary  of  Outer  Continental  Shelf  Safety  89 

Information  Data  Bases 

Appendix  D:  An  Outer  Continental  Shelf  Operating  97 

Company' 8  Management  of  Safety 

Appendix  E:  Outer  Continental  Shelf  Work  Practices  105 

Appendix  F:  Potential  of  Automation  to  Improve  Outer  109 

Continental  Shelf  Safety  Information 
Management 


•  M 


1 


1 

! 

t 


PREVIOUS  PAGE 
IS  BLANK 


1 


SUMMARY,  CONCLUSIONS,  AND  RECOMMENDATIONS 


The  U.S.  government  has  promoted  and  managed  the  development  of  the 
oil  and  gas  resources  of  the  outer  continental  shelf  (OCS)  since 
1947.  Through  regulations  and  other  management  activities,  the 
Minerals  Management  Service  (MMS)  of  the  Department  of  the  Interior 
assembles  and  maintains  a  wealth  of  engineering  and  other  data  on  OCS 
oil  and  gas  operations  for  a  number  of  purposes  —  administration, 
royalty  collection,  and  safety.  The  relation  between  specific  kinds 
of  information  and  their  use  by  the  government  is  not  always  clear. 

Some  kinds  of  basic  safety  information  are  not  gathered  by  the  MMS  on 
a  regular  basis.  Without  basic  data,  it  is  impossible  to  assess  the 
safety  of  OCS  operations  or  to  fully  develop  procedures  for  its 
improvement.  In  a  comprehensive  review  of  OCS  safety  completed  in 
1981,  the  National  Research  Council  (NRC)  concluded,  "Without  a  strong 
safety  information  component  in  the  OCS  regulatory  program,  it  is  not 
readily  possible  for  the  government  to  identify  safety  problems  and 
courses  of  action,"  (National  Research  Council,  1981). 

In  response  to  this  concern,  the  MMS  requested  in  June  1982  that 
the  National  Research  Council  provide  an  analysis  of  OCS  safety  infor¬ 
mation  systems,  including  the  types  of  information  to  be  collected, 
analytical  processes  for  utilizing  data,  and  the  techniques  for  maxi¬ 
mizing  compatibility  with  other  information  systems.  The  Commission 
on  Engineering  and  Technical  Systems  of  the  National  Research  Council 
convened  the  Committee  on  OCS  Safety  Information  and  Analysis  under 
its  Marine  Board,  with  the  charge  to  identify  the  essential  elements 
of  safety  management,  review  the  safety  management  activities  of  the 
MMS,  and  assess  the  role  and  use  of  safety  information  in  the  MMS. 

The  committee  undertook  to  assess  (1)  the  role,  organization,  and 
activities  of  the  MMS  in  promoting  and  assuring  the  safety  of  oil  and 
gas  operations  on  the  OCS;  and  (2)  the  importance  of  safety  information 
and  its  management,  i.e.,  acquisition,  analysis,  and  use  by  the  MMS  in 
OCS  safety. 

This  chapter  presents  the  committee's  summary,  conclusions,  and 
recommendations.  In  conducting  its  assessment,  the  committee  gathered 
data  concerning  OCS  safety  management  and  information  systems,  and 
presents  its  observations  concerning  those  in  this  report.  The 
recommendations  made  here  flow  from  the  report  and  the  appendices. 
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SAFETY  MANAGEMENT 


The  existence  of  safety  in  an  organization  is  related  to  a  positive 
safety  attitude.  Such  an  attitude  cannot  exist  without  top  management 
leadership,  and  is  engendered  by  a  safety  management  program  (see 
Appendix  A).  A  logical  approach  to  "government  regulation"  of  safety 
is  for  the  regulatory  body  to  look  closely  at  the  management  of  the 
organization  which  it  is  regulating,  and  encourage  safe  management 
practices  through  the  industrial  management  systems. 

The  government's  role  in  OCS  activities  is  to  act  as  the  custodian 
and  manager  of  OCS  resources,  to  motivate  industry  to  conduct  opera¬ 
tions  safely,  to  disseminate  information,  and  to  foster  the  development 
and  application  of  technology  that  will  improve  the  safety  of  OCS 
operations . 

The  Minerals  Management  Service  promulgates  and  enforces 
regulations  about  leasing  and  operations  on  the  OCS,  including  the 
safety  of  life,  property,  and  the  environment.  The  1978  amendments  to 
the  Outer  Continental  Shelf  Lands  Act  (OCSLA)  provide  the  Coast  Guard 
with  additional  specific  authority  to  regulate  the  safety  of  working 
conditions  on  the  OCS  including  conditions  on  marine  installations. 

The  Coast  Guard  has  broad  statutory  authority  to  regulate  maritime 
safety  (i.e.,  on  floating  installations). 

The  MMS  traditionally  has  limited  its  direct  authority  to  the 
operator/lessee.  Although  much  work  on  the  OCS  is  done  by  contractors, 
including  the  vast  majority  of  drilling  operations,  MMS  has  no  contact 
with  these  companies,  either  in  directing  them  how  to  operate  or  in 
obtaining  safety  or  other  kinds  of  information  from  them. 

By  limiting  its  authority  to  the  operator/lessee,  MMS  has  a 
disadvantage  in  its  efforts  to  motivate  industry  to  conduct  safe 
operations  or  to  obtain  basic  safety  data,  such  as  the  number  of  OCS 
workers  and  man-hours  worked.  Although  the  law  clearly  places  the 
ultimate  responsibility  for  all  offshore  operations  with  the  lessee/ 
operator,  the  committee  believes  that  MMS  could  choose  administratively 
to  request  information  necessary  for  safety  management  from  contrac¬ 
tors,  and  to  work  directly  with  contractors  to  promote  safety.  In 
this  regard,  the  committee  acknowledges  that  contractors  run  the  gamut 
from  prime  contractors,  such  as  drilling  contractors,  whose  supervisors 
are  in  direct  control  of  OCS  operations,  to  subsidiary  contractors 
with  limited  discretion  or  effect  on  safety  offshore.  The  MMS  should 
target  its  efforts  with  contractors  to  areas  where  there  are  signifi¬ 
cant  safety  problems,  and  where  contractors  exercise  significant 
control  over  the  safety  of  operations  or  work  performance. 

Although  the  various  federal  agencies  with  jurisdiction  on  the 
OCS  have  different  responsibilities  and  administrative  tasks  to 
fulfill,  overlap  occasionally  occurs  between  them.  In  these  cases, 
memoranda  of  understanding  (MOUs)  are  used  to  clarify  roles  and 
resolve  any  difficulties.  Gray  areas  still  remain,  however,  and  as  a 
result,  duplication  can  be  found  in  areas  of  inspection  and  accident 
reporting. 


The  MMS  limits  its  concern  for,  and  regulation  of,  workplace 
safety  to  a  strict  definition  of  the  workplace  —  the  immediate 
location  of  drilling  or  production  equipment.  The  broader  aspects  of 
workplace  safety,  such  as  habitation  offshore,  is  exluded  under  this 
definition. 

In  general,  when  there  is  an  artificial  division  or  definition  of 
responsibilities,  there  may  be  a  problem  of  the  interface  of  the 
responsibilities  (possibly  addressed  by  neither  agency),  which  can 
have  adverse  safety  implications.  The  concept  of  a  single  lead  agency 
for  safety  is  paramount  for  safety  information  reporting  and  for  safety 
management.  The  committee  concluded  that  the  Minerals  Management 
Service  should  assume  coordinating  responsibility,  since  it  already 
ha6  major  responsiblity  on  the  OCS.  This  is  consistent  with  the  OCS 
Lands  Act  amendments,  which  authorize  the  MMS  to  assure  that  incon¬ 
sistent  or  duplicate  requirements  are  not  imposed  by  the  various 
federal  agencies. 


Recommendation 

The  Minerals  Management  Service  should  exert  more  effective  leadership 
of  the  government's  OCS  safety  program  by: 

o  Coordinating  the  efforts  of  regulatory  agencies  to  eliminate 
inconsistent  or  duplicate  requirements. 

o  Coordinating  the  establishment  of  an  OCS-specific  safety 

information  system,  as  described  in  Chapters  3  and  4,  capable  of 
monitoring  the  safety  performance  of  OCS  operators  and  employers 
as  a  basis  for  documenting  and  promoting  OCS  safety. 

o  Using  the  elements  of  safety  management  identified  by  the 

committee  (see  Appendix  A)  in  conjunction  with  statistical  data 
on  safety  performance  as  a  guide  in  motivating  industrial 
managers,  and  in  effectively  implementing  its  own  program. 

SAFETY  INFORMATION  SYSTEM 

Since  the  government's  influence  over  OCS  safety  is  through  industry, 
the  government  needs  information  showing  the  effectiveness  of  proce¬ 
dures  implemented  as  the  result  of  the  policies  it  sets.  Needed  are 
end  product  or  performance  data  on  the  occurrence  of  accidents, 
incidents  of  noncompliance  or  unsafe  events,  and  violations  of 
operating  rules. 

To  be  useful,  such  data  need  to  be  recorded  in  a  manner  that 
reflects  frequency  of  occurrence  and  severity  of  event.  Furthermore, 
such  data  need  to  be  in  a  form  conducive  to  analysis.  Monitoring 
safety  performance  —  the  ability  to  document  safety  results  and 
trends  and  to  quantify  the  effects  of  policies  and  regulations  —  is 
central  to  fulfilling  the  Minerals  Management  Service's  role  in 
achieving  OCS  safety. 


A  safety  information  system  is  integral  to  monitoring  safety 
performance.  A  safety  information  system  is  a  means  of  acquiring, 
collecting,  storing,  organiring,  sorting,  retrieving,  and  analyzing 
information  on  unplanned  or  unexpected  incidents  (including,  where 
appropriate,  near  misses)  relating  to  environmental  damage  or  upset, 
bodily  injury,  illness,  disease  or  death,  and  property  damage  or 
loss.  The  MMS  already  has,  or  has  access  to,  components  of  a  safety 
information  system,  but,  the  available  system  has  the  following 
weaknesses : 

Missing  elements  Without  extensive  searching  of  records  and 
manipulation,  none  of  the  available  data  can  be  aggregated  by  operator, 
employer  or  workplace  to  assist  in  identifying  if  and  where  safety 
problems  exist  and  where  less  or  more  government  attention  is  needed. 
For  the  purpose  of  monitoring  safety  performance,  the  performance  of 
regulated  industries,  independent  contractors  as  well  as  lessees  and 
operators  must  be  monitored  and  guided.  At  the  present  time,  such 
targeting  can  only  be  accomplished  through  detailed  study  of  individual 
records. 

Monitoring  safety  performance  requires  that  both  event  data 
(e.g.,  accidents  and  incidents  of  noncompliance)  and  exposure  data 
(e.g.,  manhours  worked,  wells  drilled,  structures  in  place,  and  oil 
produced)  be  available,  and  that  the  data  sets  be  statistically 
compatible.  The  event  data  acquired  by  the  MMS  and  maintained  in  the 
Events  File  are  limited  to  the  Gulf  of  Mexico.  Coverage  of  all  OCS 
areas  is  needed.  A  major  limitation  on  the  usefulness  of  the  Events 
File  is  the  primitive  state  of  development  of  the  data  base.  Other 
than  simple  sorting  operations  by  year  or  type  of  accident,  for 
example,  analysis  can  only  be  accomplished  through  special  study. 

The  committee  understands  that  the  Minerals  Management  Service  is 
establishing  a  safety  event  data  base  at  its  headquarters  to  remedy 
these  deficiences.  The  data  base  will  use  historical  data  from  the 
Events  File,  but  will  be  national  in  scope.* 

The  exposure  data  available  to  the  MMS  are  not  as  complete  as  the 
event  data.  The  biggest  single  gap  is  that  no  population  data  are 
available  for  OCS  workplaces.  A  practical  approach  would  be  to 
require  that  employers  periodically  report  man-hours  worked  by  type  of 
work  activity  for  their  employees  working  on  the  OCS.  The  reporting 
of  lost-time  injuries  is  already  required,  and  a  form  for  man-hours 
worked  could  possibly  be  modeled  on  the  injury  reporting  form,  to 
minimize  the  reporting  burden.  This  would  enable  the  monitoring  of 
safety  performance  industry-wide  as  well  as  by  OCS  work  activity, 
individual  company,  and  OCS  region.  For  industry  concurrence  with 
such  a  program,  there  would  need  to  be  only  one  personnel  reporting 
system  for  the  OCS. 


*This  system  was  under  development  and  not  operational  at  the  time  of 
committee  deliberations.  The  committee  was  not  able  to  assess  the 
adequacy  of  its  design  or  performance. 
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Other  exposure  dete  needed  in  the  OCS  safety  information  system 
to  calculate  accident  frequencies  for  monitoring  safety  performance 
include  tallies  of:  drilling  rigs  on  the  OCS  (already  commercially 
available),  fixed  structures  (obtainable  from  the  platform  inspection 
data  base),  production  statistics  (maintained  by  the  MMS  Royalty 
Management  Division),  and  veils  drilled  (data  kept  in  Borehole  and 
Completion  File). 

Duplication  There  is  some  duplication  of  data  reporting 
requirements  and  coverage  of  data  bases.  The  duplication  arises  from 
the  separate  needs  and  requirements  of  the  several  federal  agencies. 
The  agencies  have  sought  ways  to  eliminate  burdensome  duplicative 
reporting  requirements  but  they  persist.  The  OCS  safety  information 
needs  of  all  government  agencies  can  be  met  with  a  single  system. 

Suitability  for  Analysis  The  existing  MMS  safety  reporting 
systems  are  heavily  mixed  with  engineering  and  administrative  data. 
The  safety-related  information  is  not  always  separated  or  identified 
so  that  it  can  be  readily  obtained  and  organized  in  a  unified  data 
base.  The  Minerals  Management  Service  needs  to  organize  the  data 
available  to  it,  augmenting  the  data  as  has  been  described,  to 
establish  a  safety  information  system  that  supports  monitoring  and 
analysis  of  safety  performance.  The  scope  of  the  system  should 
encompass  event  and  exposure  data.  The  data  base  should  include  all 
OCS  data  from  MMS  and  other  agencies  as  appropriate,  and  should  be 
capable  of  basic  statistical  analysis. 


Recommendation 

The  MMS  should  establish,  in  coordination  with  other  applicable 
-overnment  agencies,  a  single  OCS  Safety  Information  System  for 
monitoring  the  safety  performance  of  OCS  owners  and  employers.  The 
system  should: 

o  Acquire  comprehensive  OCS  event  and  exposure  data; 

o  Relate  events  to  specific  employers,  locations,  operations, 
and  equipment; 

o  Calculate  frequency  and  severity  rates  and  analyze  trends; 
and 

o  Permit  monitoring  of  the  relative  safety  performance  of 
owners  and  employers,  locations,  and  activities. 

The  MMS  does  not  collect  equipment  reliability  data,  although  it 
established  and  then  cancelled  a  program  to  do  so.  The  major 
operators  on  the  OCS  keep  safety  component  failure  data  on  some 
critical  components.  To  conduct  reliability  studies,  the  government 
should  access  industry  failure  data  as  necessary. 
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The  MMS  only  acquire*  specific  information  about  the  causes  of 
OCS  accidents  or  near  misses  when  it  conducts  its  own  investigation. 
Such  data  are  invaluable,  but  very  costly  when  gathered  through 
investigation.  Through  special  study,  the  Coast  Guard  has  collected 
limited  incident-specific  and  also  statistical  data  on  workplace 
injuries  and  fatalities.  These  data  are  useful  for  safety  analysis, 
but  still  lack  exposure  data. 


MINERALS  MANAGEMENT  SERVICE  SAFETY  PROGRAM 
AND  ORGANIZATION 

The  requirements  implemented  by  the  MMS  take  a  systems  approach  to  OCS 
safety  (see  Appendices  A  and  B) ,  but  lack  coordinated  structure.  Many 
MMS  activities  require  the  submission  of  data  for  engineering  evalua¬ 
tion  without  recognition  that  safety  improvement  is  an  important 
purpose  of  such  review.  A  safety  focus  for  engineering  requirements 
and  activities  suits  the  agency's  missions,  and  is  desirable  from  a 
system  safety  standpoint.  With  this  focus,  the  importance  and 
potential  of  program  components  would  be  more  evident,  as  would  gaps 
or  excesses  in  requirements. 

From  a  system  safety  viewpoint,  the  committee  was  able  to 
identify  both  gaps  and  excess  requirements  in  the  MMS  safety  program 
(see  Appendix  B).  Notable  gaps  include  the  lack  of  adequate  proce¬ 
dures  for  acquiring,  analyzing,  and  using  safety  data  in  a  coordinated 
manner,  especially  to  monitor  safety  performance  (see  pp.  27-28); 
failure  to  use  positive  incentives  (see  pp.  35-38)  (except  for  the  new 
SAFE  Program);  and  inattention  to  human  factors  (see  Appendix  E). 
Requirements  resulting  in  excessive  data  submission  were  found  in  the 
following  areas:  verification  documentation  (Appendix  B,  item  3.2), 
evidence  of  fitness  of  drilling  unit  (Appendix  B,  item  A. 2),  welding 
plan  (Appendix  B,  item  5.3),  quality  assurance  program  (Appendix  B, 
item  5. A),  and  erosion  control  reports  (Appendix  B,  item  5.8). 

The  MMS  employs  a  mix  of  professional  skills  appropriate  to  its 
program.  Changes  in  program  content  or  structure  will  necessitate 
commensurate  changes  in  skills,  including  the  addition  of  safety 
engineering  expertise.  Target  areas  in  the  future  might  include: 
management  of  the  safety  information  system;  integration  of  human 
factors  concerns  and  positive  incentive  programs  into  the  MMS  safety 
program;  and  more  extensive  use  of  goal-setting,  auditing  for 
compliance,  and  performance  monitoring. 


2.  THE  GOVERNMENT'S  ROLE  ON  THE  PCS  AND  HOW  IT 
AFFECTS  THE  ACQUISITION  OF  SAFETY  INFORMATION 


The  government's  role  with  respect  to  OCS  activities  is  as  the 
custodian  and  manager  of  OCS  resources,  to  motivate  industry  to 
conduct  operations  safely,  to  disseminate  information,  and  to  foster 
the  development  and  application  of  technology  that  will  improve  the 
safety  of  OCS  operations.  Legislation  has  assigned  the  government's 
role  to  several  agencies.  They  are  primarily  the  Minerals  Management 
Service  (MMS),  U.S.  Coast  Guard  (USCG),  Environmental  Protection 
Agency  (EPA),  Materials  Transportation  Bureau/Office  of  Pipeline 
Safety,  and  U.S.  Army  Corps  of  Engineers.  The  legislative  authorities 
and  roles  of  the  agencies  are  discussed  in  Safety  and  Offshore  Oil 
(National  Research  Council,  1981).  The  bulk  of  the  responsibility  is 
shared  by  MMS  and  USCG. 

The  MMS  is  charged  with  promulgating  and  enforcing  regulations 
having  to  do  with  leasing  and  operations  on  the  OCS,  including  the 
safety  of  life,  property,  and  the  environment.  This  includes  carrying 
out  national  policy  that  states: 

"Operations  in  the  Outer  Continental  Shelf  should  be 
conducted  in  a  safe  manner  by  well-trained  personnel 
using  technology,  precautions,  and  techniques  sufficient 
to  prevent  or  minimize  the  likelihood  of  blowouts,  loss 
of  well  control,  fires,  spillages,  physical  obstruction 
to  other  users  of  the  waters  or  subsoil  and  seabed,  or 
other  occurrences  which  may  cause  damage  to  the 
environment  or  to  property,  or  endanger  life  or  health," 

(OCSLA  43  USC  1332). 

The  Coast  Guard's  responsibilities  under  the  Outer  Continental 
Shelf  Lands  Act  (OCSLA)  include  safety  regulations  relating  to  unregu¬ 
lated,  hazardous  working  conditions  on  the  OCS  (43  USC  1333  (c)  and 
(e)).  Its  broad  authority  to  regulate  maritime  safety  also  applies  on 
floating  OCS  installations.  The  USCG  shares  responsibility  for 
inspections,  accident  reporting,  and  investigations  with  the  MMS. 


7 


8 


The  MMS  has  traditionally  liaited  it*  direct  authority  to  the 
operator/lessee.  Although  much  work  on  the  OCS  is  done  by  contractors, 
including  the  vast  majority  of  drilling  operations,  MMS  has  no  direct 
contact  with  these  companies,  either  in  directing  them  how  to  operate 
or  obtaining  safety  or  other  kinds  of  information  from  them.  By 
limiting  its  authority  to  the  operator/lessee,  MMS  has  a  disadvantage 
in  its  efforts  to  motivate  industry  to  conduct  safe  operations  or  to 
obtain  basic  safety  data,  such  as  man-hours  worked.  Although  the 
OCSLA  clearly  places  the  ultimate  responsibility  for  all  offshore 
operations  with  the  lessee/operator,  the  committee  believes  that  MMS 
could  request  information  directly  from  contractors  under  43  USC 
1348.  In  this  regard,  the  committee  acknowledges  that  contractors  run 
the  gamut  from  prime  contractors,  such  as  drilling  contractors,  whose 
supervisors  are  in  direct  control  of  OCS  operations,  to  subsidiary 
contractors  with  limited  discretion  or  effect  on  safety  offshore.  The 
MMS  should  target  its  efforts  with  contractors  to  areas  where  there 
are  significant  safety  problems,  and  where  contractors  exercise  signi¬ 
ficant  control  over  the  safety  of  operations  or  work  performance. 

Each  agency  has  a  particular  mission,  technical  expertise,  and 
operational  capability.  It  is  usually  clear  as  to  which  agency  is 
best  suited  to  fulfill  a  particular  responsibility,  however,  in  some 
cases  the  division  of  responsibility  is  not  clear.  Where  there  is 
overlap  between  agencies,  memoranda  of  understanding  (MOUs)  are 
established  to  resolve  the  difficulty.  Gray  areas  still  remain,  and 
as  a  result  there  exists  some  duplication  in  areas  of  inspection  and 
accident  reporting.  For  example,  since  MMS  and  USCG  each  have  some 
statutory  responsibility  for  human  safety  on  the  OCS,  both  agencies 
require  reporting  of  lost-time  accidents.  The  MMS  plans  to  drop  its 
injury  reporting  requirements  to  reduce  overlap  with  the  USCG. 

Another  example  is  that  MMS  and  USCG  inspect  rigs  separately,  each 
checking  for  compliance  with  its  own  regulations.  In  contrast,  a 
draft  MOU  between  the  EPA  and  the  MMS  provides  for  MMS  inspectors  to 
check  for  compliance  with  EPA  permit  conditions.** 

Duplication  exists  even  though  the  OCSLA  authorizes  MMS  to  insure 
that  "...  inconsistent  and  duplicative  requirements  are  not  imposed." 
The  joint  jurisdiction  of  USCG  and  MMS  causes  confusion.  The  committee 
recognized  that  a  single  leader  is  essential  to  effective  safety  man¬ 
agement  (Rickover,  1980).  Duplication  is  of  concern  because  identical 
information  is  not  requested  by  each  agency  since  each  uses  its  reports 


*Michelle  Hiller,  EPA,  personal  communication,  July  1983. 

^Although  memoranda  of  understanding  are  a  common  tool  to  reduce 
interagency  overlap,  agreement  on  their  terms  can  take  a  long  time. 
The  Department  of  the  Interior  and  the  EPA  have  been  trying  for  10 
years  to  reach  agreement  on  an  MOU  for  monitoring  and  enforcing  EPA 
discharge  permits. 
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for  different  purposes.  This  type  of  duplication  leads  to 
inaccuracies,  misinterpretations,  and  lack  of  completeness  as  well  as 
an  administrative  and  cost  burden  to  both  government  and  industry. 
However,  the  committee  also  recognized  that  there  is  an  absence  of 
reliable  information  on  safety  performance  on  the  OCS  that  can  be 
compared  with  onshore  operations. 

To  be  effective  in  promoting  safety  one  must  not  only  acquire 
appropriate  safety  information,  but  also  analyze,  interpret,  and 
disseminate  it.  The  MMS  devotes  little  effort  to  analysis  and 
interpretation.  The  dissemination  of  information,  which  can  be  an 
integral  part  of  an  incentive  or  motivation  program,  is  not  effectively 
exploited  by  MMS  or  USCG.  The  safety  alerts,  for  example,  are  useful 
to  industry,  and  additional  approaches  to  information  dissemination 
must  be  sought. 

Care  must  be  taken  in  developing  an  approach  to  remedy  this 
fragmentation  as  well  as  the  duplication  and  overlap  of  responsibil¬ 
ities.  It  must  be  cost  effective  and  clearly  lead  to  increased  safety. 
For  example,  the  practice  of  separate  inspections  on  a  rig  by  MMS  and 
USCG  not  only  is  burdensome  and  costly  to  industry  and  the  government, 
but  it  also  does  not  appear  to  enhance  safety.  In  general,  when  there 
is  an  artificial  division  of  responsibilities  there  may  be  a  problem 
of  the  interface  (possibly  addressed  by  neither  agency),  which  can 
have  adverse  safety  implications. 

In  the  conduct  of  inspections  and  to  analyze  and  interpret  safety 
data  effectively  (e.g.,  accident  causes  and  effects,  and  number  of 
lost-time  injuries),  there  must  be  close  cooperation  and  planning  by 
MMS  and  USCG  so  that  the  information  collected  meets  the  needs  of  both 
agencies  and  can  be  analyzed  and  interpreted.  It  is  preferable  that  a 
single  agency  acquires  the  data,  a  single  agency  analyzes  the  data, 
and  that  the  data  base  be  complete  enough  to  satisfy  the  needs  of  both 
agencies.  If  there  is  a  clearly  defined  and  strong  lead  agency  for 
the  OCS,  then  the  single  reporting  and  inspection  program  will  be  more 
easily  implemented  than  if  the  responsibilities  of  the  OCS  are  shared. 
The  concept  of  a  single  lead  agency  is  paramount  as  is  a  single  infor¬ 
mation  acquisition  system,  along  with  analyses  and  dissemination  of 
the  information. 


RESPECTIVE  ROLES  OF  GOVERNMENT  AND  INDUSTRY 

The  OCS  workplace  has  unique  hazards  and  stresses  (see  Appendix  E; 
Hunt,  1983;  and  NRC,  1981)  which  justify  extraordinary  attention  to 
safety.  Society  places  responsibility  for  providing  a  safe  workplace 
squarely  on  the  shoulders  of  the  employer  (84  Stat  1590).  The  closest 
control,  i.e.,  motivation  or  enforcement,  that  can  be  exercised  on  the 
worker  is  that  of  the  person's  supervisor.  Thus  the  training,  motiva¬ 
tion,  and  preparation  of  supervisors  is  fully  as  important  as  that  of 
industrial  workers.  The  ability  to  influence  safety  is  increasingly 
hampered  as  responsibility  moves  from  the  immediate  supervisor  to  a 
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field,  district,  or  division  office,  to  a  corporate  office,  or  to  a 
government  agency.  Contractors  who  provide  labor  or  technical  services 
on  the  OCS  also  complicate  the  chain  of  command. 

As  the  ability  to  control  actions  in  the  workplace  diminishes 
along  the  company  chain  of  command,  the  control  of  company  policy 
increases.  Similarly,  the  Coast  Guard  and  the  MMS,  which  have  no 
direct  control  over  industrial  workers,  have  extensive  control  over 
the  industrial  policies  governing  worker  actions.  Therefore, 
government  efforts  to  advance  safety  have  to  be  directed  at  industry 
management.  They  should  cause  industry  top  management  to  implement 
policy  which  allows  middle  and  lower  management  to  implement  technical 
procedures  necessary  to  accomplish  desired  goals. 

Highly  motivated  operators  can  do  a  great  deal  to  ensure  the 
safety  of  their  contractors;  several  companies  require  their 
contractors  to  have  active  safety  programs.  Operators  monitor  the 
results  of  their  contractors'  work  and  have  the  power  to  "run  off"  any 
contractor  that  does  not  adequately  perform.  Thus,  under  the  current 
system,  the  operator  is  in  much  more  direct  contact  and  has  more 
control  over  the  contractors  than  any  government  agency. 

Since  the  government's  influence  over  OCS  safety  is  through 
industry,  the  government  needs  information  that  shows  the  effective¬ 
ness  of  the  procedures  implemented  as  the  result  of  the  policies  that 
are  set.  These  are  end  product  or  performance  data  on  the  occurrence 
of  accidents,  incidents  of  noncompliance  or  unsafe  events,  and  viola¬ 
tion  of  policy.  To  be  useful,  such  data  need  to  be  recorded  in  a 
manner  that  reflects  frequency  of  occurrence  and  severity  of  event. 
Furthermore,  such  data  need  to  be  in  a  form  conducive  to  analysis. 
Monitoring  safety  performance  —  the  ability  to  document  safety 
results  and  trends,  to  quantify  the  effects  of  policies  and  regula¬ 
tions,  and  to  audit  performance  —  is  central  to  fulfilling  MMS'  role 
in  achieving  OCS  safety. 


OUTER  CONIINE KTAI  SHELF  SAFETY  INFORMATION 


A  safety  information  system  is  integral  to  monitoring  safety 
performance.  In  Appendix  A,  the  committee  defines  a  safety 
information  system  as  a  means  of  acquiring,  collecting,  storing, 
organizing,  sorting,  retrieving,  analyzing  and  disseminating 
information  on  unplanned  or  unexpected  incidents  —  including,  where 
appropriate,  near  misses  --  relating  to  environmental  damage  or  upset, 
bodily  injury,  illness,  disease  or  death,  and  property  damage  or 
loss.  The  ability  to  analyze  data  is  an  important  part  of  an  infor¬ 
mation  system.  This  capability  is  built  into  computerized  data 
bases.  Only  the  development  of  appropriate  software  is  required  to 
perform  analysis. 

The  MMS  already  has,  or  has  access  to,  components  of  a  safety 
information  system.  This  chapter  identifies  and  describes  the  safety 
information  system  components,  shows  the  extent  of  their  usefulness  in 
monitoring  safety  performance,  assesses  the  adequacy  of  the  safety 
information  system,  and  defines  the  components  of  a  safety  information 
system  that  is  sufficiently  comprehensive  to  support  the  MMS  role. 


STATUS  OF  OCS  SAFETY  DATA 

A  variety  of  data  bases  are  available  to  shed  light  on  OCS  safety. 

The  most  relevant  are  identified  in  Table  1,  and  described  in  detail 
in  Appendix  C.  Each  of  the  data  bases  is  useful  to  some  extent  for 
monitoring  OCS  safety  performance,  but  none  of  the  data  bases  is 
completely  adequate,  nor  can  they  be  integrated  with  each  other.  The 
available  data  do  support  some  bivariate  statistical  manipulations, 
and  can  be  used  to  some  extent  to  monitor  safety  performance. 


Deaths 

Both  the  Coast  Guard  and  the  MMS  keep  data  on  OCS  fatalities  (see 
Table  2).  The  disparity  in  the  data  is  the  result  of  different 
sources  of  information  and  activities  covered. 
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TABLE  2  Fatalities  on  the  Outer  Continental  Shelf 


USCGi 

MMS^ 

1976 

49 

1977 

42 

1978 

44 

1979 

42 

1980 

57 

32 

1981 

33 

11 

1982 

18 

£  Data  drawn  from  USCG  vessel  and  personnel  casualty  reporting 
system. 

£  Data  drawn  from  MMS  Events  File. 
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MMS  data  include  deaths  as  the  result  of  workplace  accidents. 

Coast  Guard  data  include  all  deaths  on  the  OCS,  whether  or  not  they 
are  OCS  workplace  accidents.  There  are  no  comparable  exposure  data 
(i.e.,  man-hours)  for  use  in  calculating  the  frequency  of  deaths  on 
the  OCS.  Thus,  these  data  cannot  be  compared  with  other  fatality  data.  • 


Injuries 

The  IADC  calculates  frequency  rates  for  lost-time  accidents  of 
offshore  drilling  workers  (see  Table  3).  These  can  be  compared  with 
data  provided  to  the  committee  by  two  OCS  operators  (see  Table  4). 

Comparable,  OCS-specific  frequency-rate  statistics  cannot  be 
developed  from  MMS  or  Coast  Guard  data  because  information  on 
exposure,  i.e.,  man-hours  on  the  OCS,  is  lacking.  The  difference  in 
accident  frequency  between  Tables  3  and  4  represents  the  difference  in 
safety  performance  between  offshore  drilling  and  production.  The 
poorer  performance  can  be  attributed  mainly  to  the  greater  risk 
present  in  drilling.  Also,  the  definitions  of  lost-time  accidents  and 
exposure  differ  between  the  tables  —  those  used  in  Table  3  result  in 
more  conservative,  higher  statistics  (see  Appendix  C).  The  improve¬ 
ment  since  1977  shown  in  the  tables  represents  the  results  of  greater 
emphasis  industry-wide  on  safety,  ’argely  on  account  of  more  compre¬ 
hensive  and  stringent  government  regulation. 

Table  5  compares  the  lost-time  accident  statistics  of  the  OCS 
with  those  of  other  industrial  sectors. 


Loss  of  Well  Control 

Historical  incident  and  frequency  data  have  been  developed  through 
special  study  (Danenberger ,  1980;  Fleury,  1983)  (see  Table  6). 
Recently,  the  MMS  has  begun  entering  incidents  of  complete  loss  of 
well  control  into  the  events  file.  This,  coupled  with  exposure  data 
(e.g.,  wells  drilled,  wells  completed,  or  producing  wells)  that  are 
kept  by  the  MMS  will  enable  the  MMS  to  calculate  the  frequency  of  lost 
well  control  incidents  in  the  future. 


Spills 

The  MMS  and  the  USCG  have  separate  requirements  for  reporting  spills; 
spill  data  bases  are  compiled  from  the  reports.  Of  the  various  data 
bases,  that  of  the  MMS  is  the  only  one  specific  to  the  OCS. 
OCS-specific  data  cannot  be  culled  easily  from  Coast  Guard  data.  Its 
systems,  however,  especially  the  Coast  Guard's  PIRS  data  base,  provide 
as  much  or  more  information  and  analytical  capability  as  those  of 
MMS.  Tables  7  and  8  provide  a  summary  of  oil  spill  incidents  and 
frequencies  from  available  MMS  information. 
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•  i 
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•  • 


•  C 
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TABLE  3 

Lost-Time  Accidents  in  Offshore  Drilling 

Total 

Accident 

Frequency 

Man-Hours 

Per  Million 

Per  200,000 

Year 

Worked 

Injuries 

Man-Hours 

Man-Hours 

1973 

15,313,919 

797 

52.04 

10.41 

1974 

3,833,4621 

782 

49.06 

9.99 

1975 

18,663,520 

781 

41.85 

8.37 

1976 

18,184,585 

1,076 

59.17 

11.83 

1977 

28,834,239 

1,343 

46.57 

9.31 

1978 

36,173,267 

1,79  7 

49.68 

9.94 

1979 

36,043,946 

1,646 

45.66 

9.13 

1980 

37,077,474 

1,518 

40.94 

8.19 

1981 

43,599,536 

1,485 

34.06 

6.81 

1982 

46,558,981 

1,231 

26.44 

5.29 

£  First 

quarter  only. 

SOURCE: 

"Charlie"  Report 

of  the  International  Association  of  Drilling 

Contractors  (IADC). 
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TABLE  4 

Frequency  of  Lost-Time 
Oil  and  Gas  Production 

Accidents  during  OCS 
per  200,000  Man-Hours 

Year 

Company  A 

Company  B 

1973 

1.2 

0.7 

1974 

1.5 

0.7 

1975 

1.7 

2.1 

1976 

1.3 

1.4 

1977 

1.7 

1.7 

1978 

1.2 

1.4 

1979 

1.3 

0.6 

1980 

0.6 

0.2 

1981 

0.5 

0.8 

1982 

0.9 

0.15 

SOURCE:  Company-confidential  data. 
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TABLE  5  Comparison  by  Industry  of  Lost-Time 
Accident  Frequencies  in  1981 


Industry  (1981  Data) 


Accident  Frequency 
(Per  200,000  Man-Hours) 


Agriculture£ 

5.9 

Mining£ 

6.2 

Heavy  construction£ 

6.3 

Manufacturing 

4.9 

Lumber  and  wood  product s£ 

8.9 

Oil  and  gas 

extraction  (drilling)£ 

6.6 

Oil  and  gas  field 

services  (production)£ 

9.2 

Water  transportation£ 

7.1 

Offshore  drilling^ 

6.8 

Offshore  production£ 

0.5 

£  Bureau  of  Labor  Statistics  Bulletin  2164. 

^  I  ADC  "Charlie"  Report  (from  Table  3).  Note  previously  cited  _ 

peculiarities  of  the  data.  • 

£  Company-confidential  data  (from  Table  4). 
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.c  blowouts  from  1968-1978 
TABLE  6  Number  and  Frequency  of  B _ _ 


phase  of  Operations 


Drilling 

Completion 

Production 

Workover 


Number 


Frequency 


1:264 

1:1,484 

1:3,100 

1:485 


SOURCE 


:  National  Research  Council,  1981. 


I 


ills 


|o-|o  icrjitt 
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TABLE  8  Frequency  of  OCS  Oil  Spills* 


Total  Oil 

Production 

Year 

Number** 

Barrels  Spilled0 

(million  bbl)^ 

Less  than  6  Barrels 

1971-1982 

1:3.7 

1:1.3 

Over  6  Barrels 

1971 

1:9.3 

1:0.2 

387.4 

1972 

1:18.7 

1:1.0 

389.3 

1973 

1:14.1 

1:0.03 

375.8 

1974 

1:15.0 

1:0.02 

343.8 

1975 

1:23.6 

1:1.01 

314.9 

1976 

1:21.1 

1:0.07 

302.9 

1977 

1:15.2 

1:0.33 

291.7 

1978 

1:22.5 

1:0.22 

280.2 

1979 

1:15.8 

1:0.96 

274.6 

1980 

1:34.7 

1:0.13 

267.2 

1981 

1:40.9 

1:0.05 

270.2 

1982 

1:80.3 

1:1.38 

292.7 

Gulf  of  Mexico  only. 

Number  of  spills  per  million  barrels  produced. 

Barrels  spilled  per  million  barrels  produced. 

Data  from  MMS.  • 


Fires/Explosions 


In  1982,  30  fires  and  2  exploaiona  occurred  on  OCS  fixed  and  floating 
°ii  and  gaa  facilities.  This  number  of  incidents  is  consistent  with 
historical  data,  as  shown  in  Figure  1.  During  the  period  1976-1979, 
for  which  numbers  of  facilities  are  available,  the  number  of  fires  and 
explosions  increased  about  3  percent  per  year.  During  the  same  period, 
the  number  of  working  drilling  rigs  increased  about  15  percent  a  year, 
and  that  of  fixed  structures  about  4  percent  a  year.  Thus,  the  rate 
of  fires  and  explosions  shows  a  level  or  slightly  declining  trend 
(National  Research  Council,  1981). 


Collisions 

Collisions  of  vessels  with  OCS  structures  are  entered  in  the  OCS 
Events  File  if  the  OCS  structure  is  damaged.  Two  collisions  are 
included  in  the  Events  File  for  1982.  Many  more  collisions  are 
recorded  in  Che  Vessel  Casualty  Reporting  System  (CASMAIN)  data  base 
of  the  Coast  Guard  because  Coast  Guard  entries  originate  with 
incidents  reported  by  the  vessel  operator. 


Loss  of  Structure 

The  Events  File  contains  data  on  lost  installations  or  major  property 
damage.  With  cumulative  platform  years  for  different  types  of  struc¬ 
tures,  which  can  be  derived  from  the  platform  inspection  data  base, 
frequency  rates  for  platform  failures  can  be  calculated  (National 
Research  Council,  1981).  The  CASMAIN  data  base  of  the  Coast  Guard 
contains  comparable  structural  failure  information  for  mobile  offshore 
drilling  units  (MODUs)  only.  Tables  9  and  10  provide  data  on  loss  of 
drilling  rigs  and  fixed  structures. 


Violations  of  Operating  Orders 

The  platform  inspection  data  base  of  the  MMS  reveals  that  in  1982, 
5,500  citations  or  INCs  (Incidents  of  Noncompliance  with  Operating 
Orders)  were  issued  by  MMS  as  the  result  of  7,000  sice  visits  by  field 
inspectors.  Most  INCs,  such  aB  those  for  pilots  out  of  tolerance, 
were  easily  corrected.  Platform  inspection  data  provide  current 
information  on  deficiencies,  which  can  be  used  to  identify  not  only 
the  activities  that  pose  the  most  consistent  problems,  but  also  the 
companies  and  locations.  These  data  also  provide  MMS  management  with 
the  means  to  monitor  the  activity  of  its  field  inspection  offices. 


Total  Annual  Events 


2< 


4 


4 


Year 


FIGURE  1  Fires  and  explosions  in  the  Gulf  of  Mexico. 


•  4 


SOURCE:  National  Research  Council,  1981. 
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TABLE  9 

Frequency  of  MODU  Loss 

(worldwide):  1973- 

■1982 

Period 

Total  Losses 

(A) 

Total  MODU-Years 

(B) 

Loss  Rate® 

(A) 

(B) 

• 

1978-1982 
(5  years) 

18 

2,537 

.71? 

• 

1973-1977 
(5  years) 

21 

1,581 

1 . 332 

1973-1982 
(10  years) 

39 

4,118 

.95? 

• 

Number  of  losses  per  cumulative  MODU  years,  calculated  as  a 
percentage. 


SOURCE-  Adapted  from  McIntosh,  1983. 
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TABLE  10 

Fixed  Offshore  Platform  Exposure 
in  the  Gulf  of  Mexico 

to  Loss* 

Time 

Interval 

Platforms 
in  Place 

Cumulative 

Platform 

Years 

(A) 

Losses 
in  Time 
Interval 

(B) 

Loss  Rate 

(A) 

(B) 

1947-1957 

267 

589 

5 

1:120 

1958-1969 

1,675 

11,479 

28 

1:410 

1970-1980 

2,556 

23,618 

2 

1:12,000 

*A  platform  is  considered  lost  if  it  was  totally  destroyed  or  so  badly 
damaged  that  it  had  to  be  replaced.  Single-well  caissons  are  not 
considered  to  be  platforms,  and  are  excluded  from  this  tabulation. 


SOURCES:  Platform  loss  data  from  the  National  Research  Council,  1981, 
and  the  MMS  Events  File;  platform  exposure  data  from  MMS. 


ASSESSMENT  OF  USEFULNESS  OF  EXISTING  SAFETY  DATA 


Mis«ing  Elements 

None  of  the  availsble  data  can  be  aggregated  by  employer  or  workplace 
to  assist  in  identifying  if  and  where  safety  problems  exist  and  where 
less  or  more  government  attention  is  needed.  For  the  purpose  of 
monitoring  safety  performance,  regulated  managements  should  include 
independent  contractors  as  well  as  lessees  and  operators.  At  the 
present  time,  such  targeting  can  only  be  accomplished  through 
time-consuming,  detailed  study,  ad  hoc,  of  individual  records. 

Monitoring  safety  performance  requires  that  both  event  data  and 
exposure  data  be  available,  and  that  the  data  sets  be  statistically 
compatible.  The  event  data  acquired  by  the  MMS  and  maintained  in  the 
Events  File  are  adequate  for  safety  analysis,  with  two  exceptions. 

o  The  Events  File  was  established  and  is  maintained  by  the  Gulf  of 
Mexico  Region.  Since  the  Events  File  was  established  14  years 
ago,  OCS  operations  have  been  undertaken  offshore  Alaska  and 
California,  and  in  the  Atlantic.  The  geographic  coverage  of  the 
historical  data  is  complete  only  for  the  Gulf  of  Mexico. 

o  The  second  limitation  on  the  usefulness  of  the  Events  File  is  the 
primitive  state  of  development  of  the  data  base.  Other  than 
simple  sorting  operations,  by  year  or  type  of  accident,  for 
example,  analysis  can  only  be  accomplished  through  special 
study.  Even  the  analysis  presented  earlier  in  this  section 
required  manual  manipulation  of  the  data. 

To  remedy  these  deficiencies,  the  MMS  is  establishing  a 
computerized  accident  information  management  system  data  base  at  its 
headquarters  that  will  contain  information  on  accidents  since  1978  and 
be  national  in  scope.*  The  data  base  is  being  established  in  dBase 
II,  a  flexible  data  management  computer  language.  As  initially 
established,  the  data  base  will  contain  event  data  only,  although  the 
system  has  the  capability  to  include  exposure  data.  The  system  will 
be  able  to  sort  events  in  a  number  of  ways,  by  operator  or  time  of 
year,  for  example,  and  also  will  be  capable  of  analyzing  trends  and 
causes  to  the  extent  that  this  information  is  available  in  the 
original  records  entered  into  the  data  base.  When  exposure  data  are 
added,  the  system  also  will  be  capable  of  calculating  accident 
frequencies.  Additional  comments  on  the  potential  of  automation  to 
improve  OCS  safety  information  management  are  contained  in  Appendix  F. 


♦The  system  was  under  development  at  the  time  of  the  committee 
deliberations.  The  committee  was  not  able  to  assess  the  adequacy  of 
its  design  or  performance. 
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The  exposure  date  available  to  the  MMS  are  not  as  complete  as  the 
event  data.  The  biggest  single  gap  is  that  no  data  on  man-hours  worked 
are  available  for  OCS  workplaces.  One  approach  to  developing  popula¬ 
tion  data  would  be  to  require  that  employers  periodically  report 
man-hours  worked  by  type  of  work  activity,  e.g.,  drilling,  production, 
well  servicing,  and  construction,  for  their  employees  working  on  the 
OCS,  exclusive  of  staff  support  located  onshore.*  Since  reports  of 
fatalities  and  lost-time  accidents  are  required  by  regulation,  accident 
frequency  rates  could  also  be  calculated  to  measure  the  acceptability 
of  safety  performance  by  total  industry,  OCS  work  activity,  individual 
company,  and  OCS  region.  For  industry  concurrence  with  such  a  program, 
there  would  need  to  be  only  one  personnel  accident  reporting  system 
for  the  OCS.  All  interested  government  agencies  should  have  access  to 
the  system.  To  minimize  regulatory  burden  on  small  business  entities, 
consideration  could  be  given  to  exempting  companies  with  10  or  fewer 
employees  from  submittal  of  the  population  data.  The  rate  information 
might  be  required  initially  on  a  semi-annual  basis  for  a  trial  period 
of  2  years  and  then  extended  thereafter  on  an  annual  basiB,  if 
justified. 

The  MM S  also  does  not  maintain  an  automated  file  of  drilling  rigs 
on  the  OCS  although  private  companies  provide  this  service  to  their 
oil  company  customers.  A  tally  of  fixed  structures  can  be  gleaned 
from  the  platform  inspection  data  base,  but  the  tally  is  not  integrated 
in  any  way  with  other  safety  information.  Similarly,  production 
statistics,  which  are  maintained  by  the  Royalty  Management  Division  of 
the  MMS,  are  available  and  useful,  but  have  not  been  integrated  with 
ocher  safety  information. 

Other  exposure  data  bases  that  are  potentially  useful  for  safety 
analysis,  but  which  are  not  currently  integrated  with  or  oriented  to 
other  safety  information,  include  the  Well  Data  File  and  the  Borehole 
and  Completion  File.  Both  files  keep  tabs  on  OCS  wells;  the  well  file 
contains  production  information,  and  the  other  contains  engineering 
data.  All  of  these  data  bases  are  maintained  in  the  Gulf  of  Mexico 
region  and  have  regional,  as  opposed  to  national,  coverage  only, 
although  similar  information  can  be  obtained  from  the  other  regions. 


Duplication 

Table  1  provides  evidence  of  substantial  duplication  of  data  reporting 
requirements,  and  coverage  of  data  bases.  The  duplication  arises  from 
the  separate  needs  and  requirements  of  the  several  federal  agencies. 
The  agencies  have  sought  ways  to  eliminate  burdensome  duplicative 
reporting  requirements,  but  they  persist.  OCS  safety  information 
needs  of  all  government  agencies  can  be  met  with  a  single  system  which 
provides  prompt  access  to  the  user  agencies. 


*An  example  of  a  form  for  these  purposes  is  OSHA  Form  200S  which  is 
used  in  a  BLS  national  sampling  program.  This  program  provides  a  very 
small  amount  of  data  on  a  few  OCS  workplaces. 


Suitability  of  Information  for  Analysis 

To  date,  information  has  not  been  developed  on  the  overall  safety 
record  of  the  offshore  oil  and  gas  exploration  and  production 
industry,  or  of  the  many  individual  companies  who  operate  on  the  OCS. 

Within  the  existing  MMS  safety  reporting  systems,  engineering 
data  are  heavily  mixed  with  administrative  data.  The  safety-related 
information  is  not  always  separated  or  identified  so  that  it  can  be 
readily  accessed  in  a  unified  data  base. 

The  MMS  needs  to  organize  the  data  available  to  it,  augmenting 
them  as  has  been  described,  to  establish  a  safety  information  system 
that  supports  monitoring  and  analysis  of  safety  performance.  The 
scope  of  the  system  should  encompass  event  and  exposure  data.  The 
data  base  should  include  all  OCS  data,  and  should  be  capable  of  the 
basic  manipulations  of  statistical  analysis.  The  best  safety  data 
system  would  result  from  a  completely  new  design  of  the  data  base. 

Such  an  approach  was  taken  by  MMS  in  its  recent  development  of  the 
revised  royalty  management  data  reporting  system,  and  should  be  given 
consideration  in  this  case. 

Individual  company  data  systems  vary  and  cannot  be  readily 
consolidated  for  comparative  purposes.  They  have  the  information 
needed  for  a  common  system,  but  the  information  has  to  be  collected 
and  consolidated  to  be  usable.  A  few  of  the  major  producing  companies 
also  accumulate  information  about  the  frequency  of  contractors' 
accidents  while  the  contractors  are  working  for  them.  Others  require 
contractors  to  provide  them  with  information  about  accidents  before 
and  during  employment.  Individual  company  systems  are  tailored  for 
the  company  and  their  insurer.  One  major  producing  company  for, 
instance,  uses  the  24-hour  exposure  criteria  described  elsewhere  for 
the  maritime  transportation  industry. 

The  MMS  does  not  collect  data  on  the  reliability  of  safety 
devices,  although  it  established  and  then  cancelled  a  program  to  do  so 
(as  described  in  Appendix  B,  item  5.7).  The  major  operators  on  the 
OCS  keep  failure  data  on  some  of  the  critical  components.  To  conduct 
reliability  studies,  the  government  may  be  able  to  access  industry 
failure  data. 

Unless  it  conducts  an  investigation,  the  MMS  does  not  acquire 
causal  data  on  OCS  accidents  or  near  misses.  Such  data  are  invaluable 
but  very  costly  to  develop  since  they  can  only  be  gathered  through 
investigation.  The  Coast  Guard  has,  through  special  study,  developed 
limited  causal  data  on  workplace  injuries  and  fatalities.  These  data 
have  been  and  will  continue  to  be  useful  for  safety  analysis,  but  they 
suffer  from  the  same  limitations  as  the  event  data;  that  is,  without 
exposure  data,  the  causal  data  cannot  be  related  to  accident  frequency 
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The  reports  of  field  inspectors  provide  s  wealth  of  information 
on  operating  deficiencies  by  company  and  location,  which  can  be  used 
for  both  internal  and  external  safety  management  purposes.  MMS  manage¬ 
ment  can  use  these  data  to  target  the  activities  that  pose  the  most 
consistent  problems,  and  also  the  companies  and  locations.  The  data 
also  provide  a  means  of  tracking  the  activities  of  field  inspection 
offices  and  field  inspectors.  However,  for  this  information  to  be 
used  consistently  and  frequently  for  safety  management  purposes,  the 
data  need  to  be  in  a  readily  available,  readily  analyzable  form.  This 
is  not  currently  the  case. 


4.  SYSTEM-LEVEL  ASSESSMENT  OF  THE 
MMS  SAFETY  MANAGEMENT  PROGRAM 


This  section  describes  approaches  to  a  safety  program,  and  analyzes 
the  links  between  safety  information  and  management.  It  draws  on  and, 
in  some  cases,  summarizes  information  presented  in  the  Appendices. 

ALTERNATE  MODES  OF  SAFETY  PROGRAM  IMPLEMENTATION 

The  MMS's  major  safety  mission  is  to  encourage  industry  to  operate 
safely.  To  influence  industry  to  act  safely,  the  government  must  have 
things  it  wants  industry  to  do  (i.e.,  set  goals  and  standards),  it 
must  be  able  to  encourage  industry  to  do  those  things  (i.e.,  enforce 
and  motivate),  and  it  must  have  a  way  to  know  if  industry  is  doing 
them  (i.e.,  determine  compliance).  The  MMS  can  apply  its  goals  and 
standards  in  a  number  of  ways.  It  can  require  specific  technologies 
and  procedures  or  set  general  performance  standards  or  safety  goals. 
The  means  of  detecting  and  motivating  compliance  with  safety 
objectives  differs  with  the  approach,  and  the  government  requires 
different  information  to  set  goals,  enforce  or  motivate,  and  determine 
compliance.  Table  11  summarizes  the  approaches  to  regulation  and 
their  different  information  characteristics  and  requirements. 

The  most  specific  type  of  regulation  is  that  which  requires 
specific  technologies  or  practices.  For  example,  Gulf  Coast  OCS  Order 
1  describes  precisely  how  OCS  structures  must  be  identified  (30  CFR 
250).  Another  example  is  the  Coast  Guard  regulations  that  prescribe 
specifications  for  life  jackets  and  survival  suits  (46  CFR  Sub.  I-A, 
parts  107-109;  33  CFR  Sub.  N.  parts  140-147).  Specific  standards  are 
straightforward  —  the  company  simply  has  to  follow  the  directions 
— and  it  is  similarly  easy  for  the  government  to  check  for  compliance 
because  an  inspector  can  go  by  the  book.  On  the  other  hand,  the  mere 
employment  of  a  technology  does  not  ensure  that  it  will  be  maintained 
and  used  correctly. 

Detailed  knowledge  of  technologies  or  practices  is  required  to 
set  specific  standards.  That  is  why  such  standards  are  often 
developed  by  industry  and  then  incorporated  into  regulation  by 
reference . 
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The  establishment  of  specific  standards  may  tend  to  freeze 
technology  —  thus  attention  to  updating  is  important.  Using  industry 
consensus  standards  that  are  updated  frequently,  such  a6  American 
Petroleum  Institute  (API)  recommended  practices,  circumvents  some  of 
the  problems  of  out-of-date  standards,  and  also  reduces  the  information 
required  of  government. 

At  a  more  general  level,  standards  can  specify  technologies  or 
practices  the  operator  should  use,  but  allow  flexibility  in  choosing 
the  specifics.  There  is  no  clear  dividing  line  between  performance 
standards  and  regulations  which  specify  technologies  and  practices, 
but  rather  a  spectrum.  For  example,  a  requirement  that  blowout 
preventers  be  in  place  and  be  testable  at  a  certain  pressure  allows 
more  flexibility  than  a  standard  that  describes  the  exact  type  and 
configuration  of  blowout  preventers,  but  it  is  less  flexible  than  a 
performance  standard  that  requires  well  control  maintenance  with  no 
specifications  about  how  well  control  should  be  achieved.  Many  OCS 
orders  are  of  this  intermediate  type,  requiring  equipment  that  meets 
certain  performance  characteristics  without  specifying  the  design. 

For  example,  Gulf  of  Mexico  Order  #2,  Section  6.2,  specifies  require¬ 
ments  for  mud  pit  level  indicators,  mud  volume  measuring  devices,  and 
gas  detecting  equipment,  but  it  says  nothing  about  the  required  design. 

Determining  compliance  with  equipment-performance  standards  is 
often  more  difficult  than  determining  compliance  with  more  specific 
standards.  It  is  easier  for  an  inspector  to  tell  if  fire  hose  brand  X 
is  on  the  rig  than  to  tell  if  the  rig's  fire  hose  can  pump  X  gallons 
per  minute.  Compliance  with  some  performance  standards  can  be  checked 
by  testing  the  equipment.  For  other  standards,  it  might  be  very  diffi¬ 
cult  for  an  inspector  on  a  rig  to  determine  if  a  piece  of  equipment 
does  what  it  is  supposed  to  do.  Similarly,  it  is  easier  to  see  if  a 
company  follows  a  specific  procedure  than  it  is  to  determine  if  the 
procedure  a  company  follows  is  adequate.  To  set  equipment  performance 
standards  requires  less  detailed  knowledge  but  more  general  information 
than  specific  standards;  the  government  needs  to  know  both  what  perfor¬ 
mance  levels  are  needed  for  safety  and  the  performance  level  that 
state-of-the-art  equipment  is  capable  of  achieving.  The  advantage  of 
an  equipment  performance  standard  is  that  it  permits  much  more  flexi¬ 
bility  in  technology  and  practice  --  a  company  is  free  to  use  a  newer 
technology  that  performs  the  same  function  more  efficiently. 

At  a  next  more  general  level,  a  system  safety  level,  the 
regulations  describe  in  general  terms  the  required  technologies  and 
programs.  Examples  of  this  might  be  requirements  for  training 
workers,  that  a  platform  be  able  to  withstand  a  wave  of  particular 
force,  or  that  it  have  a  firefighting  system  capable  of  extinguishing 
certain  types  of  fires.  These  regulations  put  the  responsibility  on 
the  company  to  demonstrate  that  it  has  these  capabilities,  but  leave 
the  means  of  compliance  up  to  the  company.  This  type  of  approach  is 
used  in  Norway,  where  the  operators  are  unambiguously  responsible  for 


the  safety  of  their  operations.*  In  the  United  States,  requirements 
for  exploration  plans,  comprehensive  permit  applications,  and  platform 
verification  are  at  this  level.  In  documents  such  as  the  Application 
for  Permit  to  Drill  (APD)  of  the  MMS,  the  operator  must  specify  in 
detail  the  technologies  and  procedures  to  be  used.  These  are  checked 
for  adequacy  by  the  MMS  district  office  to  determine  if  they  are  suffi¬ 
cient.  In  the  Platform  Verification  Program,  independent  certifying 
organizations  review  the  design  and  construction  of  platforms  to 
certify  their  safety. 

At  this  level,  compliance  is  determined  by  reporting  requirements 
and  government  checking.  The  government  needs  to  have  enough  expertise 
to  determine  if  the  operator's  plans  are  adequate.  The  advantage  of 
system  level  programs  is  that  they  allow  a  great  deal  of  flexibility 
and  opportunities  for  innovation.  Innovations  can  be  made  if  the 
operator  can  demonstrate  that  they  are  adequate. 

The  most  general  level  of  regulation  is  a  statement  of  goals  or 
standards,  which  specify  the  permissible  amounts  of  pollution  or 
frequency  of  injuries.  No  comprehensive  set  of  safety  goals  has  been 
established  for  the  OCS  (although  U.S.  operators  are  unambiguously 
responsible  for  the  safety  of  their  operations).  Norway  presents  some 
contrast  in  this  respect;  there,  a  numerical  goal  for  the  reliability 
of  offshore  structures  has  been  established.  The  Norwegian  system  can 
be  cumbersome  to  implement  because  it  calls  for  extensive  documentation 
on  the  part  of  the  operator  and  documentation  review  on  the  part  of 
the  regulator.  Furthermore,  the  effectiveness  of  the  Norwegian  goal 
for  reliability  has  not  been  evaluated.  Also,  the  workability  of  a 
meaningful  demonstration  that  the  numerical  goal  has  been  achieved  has 
not  been  addressed. 

Performance  standards  are  common  in  EPA's  air  and  water  pollution 
regulations,  such  as  automobile  emissions  standards,  which  specify 
allowable  discharges  into  the  air  and  water  without  saying  how  they 
are  to  be  obtained.  Performance  standards  are  less  appropriate  for 
regulating  events  for  which  no  level  of  incidence  is  acceptable,  such 
as  deaths  or  major  pollution  events. 

Regardless  of  the  technique(s)  of  regulation  employed,  the  MMS 
has  a  legal  obligation  to  require  safe  operations,  including  requiring 
a  floor  or  basic  level  of  safety  performance.  The  great  majority  of 
operating  companies  will  achieve  the  desired  level  of  safety  perfor¬ 
mance  as  the  result  of  corporate  objectives  and  programs  and  in 
response  to  government  regulations.  However,  the  MMS  needs  to  take 
into  account  that  at  any  point  in  time  there  may  be  some  operators  in 
some  locations  who  do  not  respond  to  motivation  and  do  not  act 
responsibly.  By  requiring  every  operator  to  perform  at  some  basic 
level  of  safety  performance  (under  the  threat  of  suspension  of 
operations),  the  MMS  is  protecting  itself,  the  offshore  oil  and  gas 
industry,  and  the  nation,  from  slothful  operators. 

*Dr.  Chris  Hill,  Massachusetts  Institute  of  Technology,  personal 
communication,  March,  1983. 
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FACTORS  TO  CONSIDER  WHEN  SETTING  GOALS 

The  setting  of  safety  goals  is  highly  desirable.  Goals  can  motivate 
if  they  are  set  at  a  level  that  challenges  the  skills  of  individuals 
and  organizations,  and  are  not  too  easy  to  achieve  nor  so  difficult  as 
to  be  unachievable.  However,  when  developing  safety  goala  it  becomes 
clear  that  there  are  so  many  associated  problems  that  it  is  an 
extremely  difficult  task.  One  of  the  main  difficulties  is  that  goals 
must  be  verifiable,  to  know  if  they  are  attained.  Goals  might  need  to 
be  different  for  each  facility.  They  might  depend  upon  the  activity 
(exploration  versus  production);  geographical  region;  environment 
(e.g.,  sensitive  ecosystem  or  harsh  weather);  production  capacity;  and 
the  facility's  age.  A  set  of  goals  would  be  needed  rather  than  a 
single  safety  goal  for  a  given  facility,  and  they  may  be  both  qualita¬ 
tive  and  quantitative  in  nature.  Some  goals  may  be  absolute,  others 
may  be  relative. 

If  attainment  of  a  goal  is  subject  to  factors  beyond  an  operator's 
control,  then  a  process  or  means  goal  rather  than  an  end  goal  may  be 
desirable.  Goals  need  to  be  flexible  so  that  they  can  be  changed  with 
time,  or  if  conditions  change.  Goals  ought  to  be  carefully  set  and 
then  evaluated  on  a  test  basis  for  a  few  facilities  before  they  are 
implemented  indus cry-wide . 

When  one  sets  a  performance  standard,  one  is  in  effect  setting  a 
goal.  However,  standards  may  be  Coo  general,  goals  too  vague,  and 
feedback  too  infrequent  to  assure  adherence  to  standards  and  attain¬ 
ment  of  goals.  While  performance  standards  may  be  a  very  important 
part  of  the  MMS  safety  and  information  system,  care  is  needed  to 
ensure  that  suitable  standards  are  selected  and  adequate  feedback  is 
provided.  The  objective  is  not  to  provide  the  owner /employer  with 
ideal  or  unrealistic  performance  standards,  but  rather  with  goals  and 
feedback  which  will  improve  safety  behavior  in  the  workplace. 


OPPORTUNITIES  AFFORDED  BY  MONITORING  SAFETY  PERFORMANCE 

The  lack  of  an  information  system  for  monitoring  the  safety  performance 
of  OCS  owners/employers  affects  many  aspects  of  OCS  safety  regulation 
as  previously  explained.  This  section  describes  the  opportunities 
afforded  by  monitoring  safety  performance. 

Once  incident  and  rate  data  are  available,  indices  of  safety 
performance  can  be  constructed  concerning  fatalities,  injuries, 
spills,  other  operational  incidents,  and  structural  failures.  The 
indices  can  be  constructed  for  owners  and  employers.  They  can  be 
aggregated  by  region,  type  of  operation,  type  of  event,  or  type  of 
company,  and  depending  on  the  flexibility  of  the  data  base,  by  other 
factors.  The  data  can  be  kept  confidential  or  can  be  made  anonymous 
for  public  circulation.  Publicizing  safety  performance  can  motivate 


companies  to  direct  their  attention  to  safety.  For  example,  occurrence 
of  accidental  spills  has  dropped  concurrently  with  acceptance  of  the 
requirement  to  report  spills  to  government  authorities  (see  Table  8); 
this  suggests  that  simply  requiring  events  to  be  entered  in  the  public 
record  may  motivate  companies  to  work  on  the  problems. 

Behavior  also  can  be  affected  by  both  positive  and  negative 
incentives.  The  current  system  of  regulation,  inspection,  and 
enforcement  consists  primarily  of  negative  incentives  to  motivate  safe 
practices.  Positive  incentives  are  needed;  they  might  include  awards 
or  reduced  enforcement  burden.  Accurate,  up-to-date  safety  performance 
information  is  a  necessary  element  of  a  positive  incentives  program. 

The  following  are  examples  of  applications  of  performance  data 
for  the  purpose  of  enhancing  and  encouraging  safe  practices. 

Non-Public  Applications 

o  From  time  to  time,  lessees,  operators,  and  contractors  could  be 
provided  with  a  safety  performance  status  report.  The  report 
would  cite  the  best,  worst,  and  mean  safety  records  for  the 
activities  in  which  the  company  is  engaged,  and  the  company's 
safety  record.  Other  comments  could  be  included  as  appropriate. 

o  The  frequency  and  thoroughness  of  inspections  could  be  based  to  a 
large  extent  on  safety  performance.  Such  a  policy  would  remind 
the  poorer  performer  of  safety,  and  because  inspections  take  time 
and  thus  are  costly  to  the  operator,  it  would  reward  the  good 
performers  by  taking  less  of  their  time.  This  is  an  example  of  a 
relaxation  of  a  negative  incentive.  It  would  also  make  better 
use  of  government  resources  by  concentrating  them  on  problems. 

o  The  MMS  could  consider  safety  performance  in  awarding  and  setting 
terms  of  leases  and  conditions  of  conducting  operations.  This 
would  require  a  statutory  change. 

Public  Applications 

o  Positive  incentives  such  as  awards  and  recognition  are 

particularly  helpful  in  spurring  individuals  to  act  safely.  This 
is  important  since  so  many  accidents  are  attributed  to  human 
error.  Similarly,  awards  in  recognition  of  safe  performance  are 
helpful  in  motivating  companies  to  act  safely. 
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o  A  vehicle  for  making  comprehensive  safety  performance  information 
widely  available  could  be  the  addition  of  an  environment  and 
safety  chapter  to  the  "Summary  Report"  series  of  the  OCS  Oil  and 
Gas  Information  Program  of  the  Minerals  Management  Service. 

Summary  reports  are  prepared  periodically  on  the  OCS  activity  in 
each  region,  and  are  distributed  widely  to  interested  persons  in 
the  industry  and  to  state  and  local  government  officials. 

o  Public  media  could,  from  time  to  time,  be  provided  with 

up-to-date  information  on  safety  performance.  These  might 
include  lists  of  the  10  best  or  worst  operators  or  contractors 
along  with  statistical  synopses  of  safety  performance. 

o  A  public  annual  award,  a  positive  incentive,  to  the  best  safety 
motivation  program  by  large  and  small  contractors  could  require 
those  who  compete  to  disclose  their  methods  as  well  as  demonstrate 
that  they  work  well.  Hence  information  not  in  the  public  domain 
prior  to  the  award  process  would  become  accessible  to  both 
federal  agencies  and  companies. 

The  kinds  of  activities  outlined  above  would  make  it  possible  for 
workers  to  compare  the  safety  records  of  companies.  Some  might  choose 
to  work  for  safer  companies.  This  might  make  it  more  costly  for  poor 
performers  to  hire  workers,  and  would  provide  an  incentive  for  a 
greater  emphasis  on  safety.  Similarly,  companies  hiring  contractors 
might  favor  safer  companies.  Publicizing  safety  records  might  also 
promote  competition  in  safety  among  workers  and  between  companies. 

Many  companies  use  internal  competition  between  divisions  or  between 
rigs  to  promote  safety,  and  it  seems  to  be  a  powerful  motivating 
technique.  Finally,  some  public  pressure  in  favor  of  safer  companies 
is  likely  to  result  from  publicizing  safety  records. 

Even  the  best  positive  incentive  safety  program  may  have  little 
impact  if  the  link  between  incentive  use  and  improved  safety  perfor¬ 
mance  is  not  perceived.  Delays  in  making  awards,  poorly  defined 
criteria,  inappropriate  incentives,  and  many  other  related  factors  can 
mask  these  linkages. 

Incentives  are  clearly  a  basic  part  of  any  safety  information  and 
utilization  system,  but  their  use  is  complex.  Expert  professional 
staff  is  required  to  select  and  evaluate  incentive  systems.  Positive 
incentives  are  cost-effective  in  that  they  lead  to  a  more  modest 
federal  enforcement  role,  and  they  make  information  available  to  a 
broader  spectrum  of  users. 

The  offshore  industry  already  uses  positive  incentive  programs, 
and  the  API  has  published  descriptions  of  a  variety  of  approaches 
which  might  be  used,  as  well  as  descriptions  of  some  specific  safety 
award  methods  (American  Petroleum  Institute,  1974). 
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The  MMS  h*«  developed  an  OCS  Safety  Award  for  Excellence  (SAFE) 
program  to  recognize  exemplary  performance  on  the  OCS  by  a  leasee,  an 
operator,  a  contractor,  or  individuals.  The  process  of  announcing  the 
program,  receiving  applications,  evaluating  applications,  and  making 
and  publicizing  awards  is  expected  to  motivate  safety  performance  in  a 
number  of  ways.  It  is  expected  to: 

o  Elevate  the  awareness  of  safety  and  pollution  prevention  by 
recognizing  exemplary  performance; 

o  Encourage  voluntary  compliance  with  regulatory  requirements 
to  increase  environmental  protection,  safety  of  operations, 
and  conservation  of  resources; 

o  Provide  the  public  with  a  better  understanding  of  the 
professional  manner  in  which  oil  and  gas  operations  are 
conducted  on  the  OCS; 

o  Encourage  excellence  in  safety  and  pollution  prevention 
through  the  development  and  implementation  of  new 
technologies  and  practices;  and 

o  Recognize  that  safe  operating  practices  enhance  the 
protection  of  offshore  personnel. 

The  OCS  districts  of  the  Minerals  Management  Service  make  SAFE 
awards  twice  a  year.  A  national  award  is  made  once  a  year.  The  first 
SAFE  awards  were  presented  in  1983. 

In  addition  to  structuring  its  development  of  positive  incentive 
activities  along  the  lines  suggested,  the  MMS  should  consider  period¬ 
ically  evaluating  the  safety  and  motivation  activities  of  owners  and 
employers.  To  evaluate  companies  effectively,  the  MMS  would  either 
establish  an  in-house  capability  in  human  and  organizational  safety 
motivation,  employ  another  government  agency  that  has  this  capability, 
or  contract  for  such  services. 

Before  it  can  fully  reap  the  benefits  of  monitoring  safety 
performance,  the  MMS  needs  to  complete  the  supporting  data  base, 
described  in  the  previous  chapter,  including  the  development  and 
distribution  of  safety  performance  information.  Furthermore,  its 
procedures  need  to  reflect  the  technical  wisdom  of  safety 
professionals  and  others  who  make  use  of  the  safety  data. 

THE  IMPORTANCE  OF  ANALYZING,  INTERPRETING, 

AND  DISSEMINATING  SAFETY  INFORMATION 

The  MMS  collects  much  safety-related  information.  Some  information, 
such  as  notice  of  accidents,  is  provided  in  response  to  reporting 


requirements.  Other  operational  information  germane  to  safety  is 
provided  in  the  form  of  plans  for  review  and  approval.  Still  other 
safety-related  information  may  be  developed  directly  by  the  MMS. 

Information  should  be  acquired  in  response  to  the  needs  of 
decisionmakers.  To  be  useful,  information  systems  should  consist  of 
information  acquisition,  analysis,  and  utilization  elements.  While 
the  MMS  has  in  place  some  necessary  OCS  safety  information  elements, 
these  elements  have  not  been  integrated  into  an  analysis  and  utili¬ 
zation  component  to  support  improved  safety  regulation  and  industrial 
safety.  Even  so,  the  MMS  has  devoted  some  effort  to  greater  analysis 
and  use  of  safety  information.  Examples  include  analyses  of  oil  well 
blowouts  (Danenberger ,  1981;  Fleury,  1983),  and  analytical  reviews  of 
OCS  Safety  Alerts  (Oil  and  Gas  Journal,  May  2,  16,  30,  1983). 

Developing  an  organization  within  the  MMS  for  the  purpose  of 
safety  information  analysis  and  utilization  would  provide  an  organi¬ 
zational  home  for  the  safety  information  activities  of  the  MMS.  It 
would  provide  a  locus  for  the  MMS  safety  mission  that  would  be  bene¬ 
ficial  in  focusing  technology  development,  regulatory  enforcement,  and 
motivational  programs  on  safety  objectives. 


ASSESSMENT 

The  MMS'  OCS  safety  regulatory  program  contains  some  of  each  of  the 
kinds  of  regulations  discussed  in  Table  11.  This  mix  of  approaches  is 
appropriate,  given  the  range  of  objectives  of  OCS  regulations  and  the 
wide-ranging  subject  matter.  The  review  of  MMS  safety  programs  con¬ 
tained  in  Appendix  B  and  above  reveals  certain  areas  for  attention. 

The  Minerals  Management  Service's  requirements  contain  many 
components  inherent  in  a  systems  approach  to  OCS  safety  (see 
Appendices  B  and  C),  but  the  components  have  neither  been  organized 
m —  drawn  together.  Many  of  the  current  activities  of  MMS  require  the 
submission  of  data  for  engineering  evaluation  by  the  government  without 
recognition  that  the  overriding  purpose  of  this  review  is  safety.  A 
safety  focus  for  MMS  engineering  requirements  and  activities  is 
appropriate  to  the  implementation  of  the  agency's  missions,  and  is 
desirable  from  a  system  safety  standpoint.  With  a  safety  focus,  the 
importance  and  potential  of  the  program  components  would  be  more 
evident,  as  would  gaps  or  excesses  in  requirements. 

From  a  system  safety  viewpoint,  the  committee  was  able  to  identify 
both  gaps  and  excess  requirements  in  the  MMS  safety  program  (6ee 
Appendix  B).  Notable  gaps  include  the  lack  of  ability  to  acquire, 
analyze,  and  use  safety  data  in  a  coordinated  manner,  especially  to 
monitor  safety  performance  (see  pp.  27-28);  failure  to  use  positive 
incentives  (see  pp.  35-38)  (except  for  the  new  SAFE  program);  and, 
inattention  to  human  factors  (see  Appendix  E).  Requirements  resulting 


40 


in  excessive  or  duplicative  data  submission  were  found  in  the  following 
areas:  verification  documentation  (Appendix  B,  item  3.2),  evidence  of 
fitness  of  drilling  unit  (Appendix  B,  item  4.2),  welding  plan  (Appendix 
B,  item  5.3),  quality  assurance  program  (Appendix  B,  item  5.4),  and 
erosion  control  reports  (Appendix  B,  item  5.8). 

Another  issue  is  the  development  of  a  staff  of  safety  experts 
within  the  MMS  who  can  participate  in  the  administration  of  the  safety 
program.  Many  MMS  requirements  are  implemented  through  reports  or 
applications  prepared  by  industry  which  are  then  approved  or  dis¬ 
approved  by  government.  The  effectiveness  of  this  approach  depends  to 
a  great  extent  on  the  technical  qualifications  of  the  government 
personnel  who  review  the  materials  that  are  submitted,  or  who  inspect. 
The  MMS  has  a  mix  of  professional  skills  that  is  appropriate  to  the 
implementation  of  the  existing  program.  Changes  in  program  content  or 
structure  would  necessitate  some  changes  in  the  skills  of  the  MMS. 

Two  examples: 

o  Were  the  MMS  to  establish  a  central  office  to  oversee  its 
safety  program,  including  managing  an  OCS  safety  data  base 
and  targeting  regulatory  efforts  accordingly,  it  would  be 
appropriate  to  develop  or  acquire  appropriate  system  safety 
expertise  for  program  management. 

o  For  the  MMS  to  pay  greater  attention  to  human  factors,  it 
will  need  the  assistance  of  experts  in  workplace  safety  and 
human  behavior. 

Other  models  for  regulatory  implementation,  if  used  by  the  MMS, 
would  call  for  other  skills  on  the  part  of  MMS  personnel.  Some  regula¬ 
tory  agencies,  notably  the  Nuclear  Regulatory  Commission,  have  adopted 
an  audit  approach  to  regulation.*  In  an  audit  approach,  companies  are 
required  to  have  certain  plans  and  programs  and  to  keep  records  of 
compliance  with  goals,  standards,  and  regulations,  but  they  are  not 
required  to  turn  over  records  or  otherwise  report  to  the  government. 
Instead,  from  time  to  time,  the  government  audits  the  company's 
records  to  determine  compliance  and  achievement  of  goals.  Auditing 
reduces  paperwork  and  eliminates  duplication  between  company  and 
government  requirements.  Although  the  opportunity  for  cheating  will 


*The  reader  should  be  aware  that  the  Nuclear  Regulatory  Commission's 
(NRC)  use  of  audit  is  related  to  a  different  problem  than  faced  by 
MMS.  The  NRC  must  contend  with  and  manage  a  voluminous,  complex,  and 
diverse  data  base  that  includes  product  or  work  inspection 
certifications,  worker  qualification  certifications,  instrument 
calibration  certifications,  and  material  certif ications  for  each  of 
the  many  manufacturing  and  construction  steps  for  an  enormously  large 
and  complex  installation. 
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always  exist,  it  can  be  reduced  with  civil  or  criminal  penalties,  if 
audits  have  a  potential  disadvantage  it  is  that  they  require  expertise 
and  diligence  on  the  part  of  government  personnel  and  good  intentions 
on  the  part  of  industry  to  ensure  safety.  If  a  company  were  to  cut 
corners  and  was  not  audited,  a  decreased  level  of  safety  could  result. 

More  extensive  use  of  goal-setting,  auditing  for  compliance,  and 
performance  monitoring  would  focus  greater  attention  on  safety  while 
reducing  regulatory  burdens.  Yet,  reorienting  the  OCS  safety  program 
in  this  manner  would  require  new  skills  on  the  part  of  MMS  personnel. 
Regulatory  engineers  and  field  inspectors  would  have  to  develop  knowl¬ 
edge  of  management,  system  safety,  and  safety  engineering.  Petroleum 
engineers  would  need  to  be  augmented  by  human  factors  and  system  safety 
experts.  Those  who  review  and  inspect  would  need  to  learn  the  related 
but  different  tasks  involved  in  conducting  audits.  Planning  for  such 
innovations  would  be  facilitated  by  phasing  in  trial  programs  and 
analyzing  the  results. 
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APPENDIX  A* 


ELEMENTS  OF  SAFETY  MANAGEMENT  SYSTEMS 


NATURE  OF  SAFETY 


A  major  detriment  to  safety  is  the  public's  lack  of  understanding  of 
the  nature  of  safety  or  how  safety  is  achieved.  Generally,  public 
attention  is  drawn  to  safety  by  accidents.  Numerous  books  and  papers 
have  shed  considerable  light  on  the  nature  of  safety.  Many  have  had 
different  approaches,  but  overall  there  has  been  a  remarkable 
similarity  in  some  of  the  basic  ideas  which  have  been  propounded. 

One  dictionary  defines  safety  as  freedom  from  danger,  injury,  or 
damage  (Guralnik,  1978).  Since  the  concepts  of  safety  are  sometimes 
difficult  to  understand  or  assimilate,  it  is  useful  to  look  at  the 
opposite  of  safety,  i.e.,  a  condition  where  accidents  causing  danger, 
injury,  or  damage  occur.  Accidents  are  defined  as  unplanned  or 
unexpected  happenings  (Guralnik,  1978).  Many  safety  professionals 
believe  that  near  miss  incidents  are  as  important  statistically  as 
actual  incidents. 

Many  managers  pride  themselves  on  conducting  their  operations  in 
such  a  competent  manner  as  to  minimize  unplanned  or  unexpected  hap¬ 
penings.  This  objective  is  the  result  of  sound  management  practices, 
such  as  organization,  planning,  adequate  training,  competent  °"per- 
vision,  and  planned  maintenance.  If  these  management  practices  can  be 
used  to  minimize  unplanned  and  unexpected  happenings,  they  can  also  be 
used  to  achieve  safety.  Thus,  safety  is  closely  related  to  good 
management . 

It  also  follows  that  safety  is  not  an  independent  discipline,  nor 
is  it  a  commodity  or  thing  which  can  be  simply  acquired.  It  might  be 
likened  to  an  attitude  or  an  operating  philosophy  which  develops  within 
an  organization,  and  within  an  individual.  Safety  can  be  nurtured, 
improved,  and  refined  through  training  and  repetition.  It  cannot  be 
achieved  just  by  hiring  a  safety  inspector  or  a  safety  engineer  to 
perform  safety-related  duties,  or,  for  that  matter,  just  by  developing 
a  safety  information  system. 


*This  background  paper  was  compiled  by  the  committee  based  on  the 
findings  of  its  study. 


definitions 


The  committee  considered  it  necessary  to  define  some  of  its 
terminology.  This  need  for  definition  has  been  previously  recognized 
in  studies  of  safety  (Miller,  1979). 

o  Safety  information  comprises  reports,  investigations, 

analyses,  and  statistics  concerning  unplanned  or  unexpected 
incidents  relating  to  environmental  damage  or  upset;  bodily 
injury,  illness,  disease,  or  death;  or  property  damage  or 
loss  occurring  on  or  adjacent  to  the  outer  continental  shelf 
(OCS)  as  a  result  of  oil  and  gas  operations. 

Most  information  relating  to  or  concerned  with  management 
could  be  referred  to  as  safety  information.  There  seems, 
however,  little  point  in  confusing  the  concept  of  safety  by 
tagging  various  forms  of  conventional  management  information 
as  safety  information.  It  seems  more  reasonable  to  limit  the 
concept  of  safety  information  to  matters  pertaining  to  safety 
or  the  lack  of  safety.  Safety  in  itself  generates  little 
information  and  few  statistics,  but,  the  opposite  condition, 
a  lack  of  safety,  does  generate  information  and  statistics. 

If  one  studies  or  investigates  accidents  or  other  unplanned 
events  it  is  often  possible  to  determine  their  number, 
severity  and  frequency,  and  possibly  their  causes.  Such 
information  can  be  applied  to  eliminating  or  minimizing 
unplanned  events.- 

o  Information  system  pertains  to  a  means  of  acquiring, 
collecting,  storing,  organizing,  sorting,  retrieving, 
analyzing,  and  disseminating  one  or  more  types  of 
information,  including,  but  not  limited  to,  statistics, 
reports,  and  technical  papers  which  are  in  some  convenient 
form  such  as  printed  pages,  tables,  graphic  displays, 
computer  media,  or  video/audio  recordings. 

o  Safety  information  system  pertains  to  a  means  of  acquiring, 
collecting,  storing,  organizing,  sorting,  retrieving, 
analyzing,  and  disseminating  information  on  unplanned  or 
unexpected  incidents  relating  to  environmental  damage  or 
upset;  bodily  injury,  illness,  disease,  or  death;  and 
property  damage  or  loss. 

o  Management  information  systems  are  information  systems 

designed  to  handle  one  or  more  types  of  information  for  the 
use  and/or  guidance  of  management. 

Management  information  systems  are  designed  to  furnish 
necessary  information  to  management  to  enable  managers  to 
make  organized,  sound,  and  logical  decisions.  In  the  context 
of  this  study,  a  management  information  system  might  comprise 
various  information  systems,  including  safety  information 
systems,  and  a  variety  of  technical  data  from  geosciences  to 
economics . 


o 


to  operate  a  specific  information  system.  This  term  could  be 
applied  to  the  technique  or  system  used  in  operating  and 
managing  a  specific  information  system.  It  could  conceivably 
be  applied  to  a  person  or  a  relatively  limited  group  of 
people  assigned  the  task  of  managing  an  information  system. 

o  Management  system  pertains  to  a  pre-planned  and  organized 
method  of  evaluation,  analysis,  and  decision  making  created 
for  the  purpose  of  assisting  decisionmakers  in  the  skillful 
direction  of  a  specific  activity,  operation,  or  other  area  of 
interest . 

o  Safety  management  system  is  an  organized  plan  to  acquire, 

collect,  store,  analyze,  organize,  disseminate,  and  evaluate 
all  types  of  safety  information  relating  to  operations  and 
with  provisions  to  use  such  evaluations  to  improve  safety 
through  the  reduction  of  unplanned  and  unexpected  events. 


PRECEDENTS  FOR  REGULATORY  SAFETY  MANAGEMENT  SYSTEMS 

Most  regulatory  safety  management  systems  have  been  developed  over 
time  in  response  to  a  need  indentified  by  Congress,  usually  as  a 
result  of  some  particularly  severe  accident  involving  lives,  property, 
or  the  environment.  One  of  the  early  examples  of  such  a  system  was 
the  Steamboat  Inspection  Service,  which  was  established  to  cope  with 
accidents  to  steamboat  boilers.  This  agency  was  later  merged  with  the 
U.S.  Coast  Guard  which  is  still  involved  with  regulatory  matters 
covering  ship  safety.  The  present  regulatory  safety  system,  however, 
is  far  more  comprehensive  and  broader  based  than  the  initial  safety 
systems  established  by  the  Steamboat  Inspection  Service. 

There  are  other  regulatory  safety  management  systems  in 
government  which  have  adopted  and  explored  a  variety  of  strategies  for 
achieving  safety.  All  of  these  provide  some  assistance  in  determining 
which  strategies  may  be  most  useful  and  successful  to  the  Minerals 
Management  Service  (MMS).  However,  there  is  no  readily  available, 
highly  efficient  ,  well-tested  regulatory  safety  management  system  in 
place  that  can  be  used  as  a  comprehensive  model  for  the  development  of 
the  ultimate  OCS  safety  management  system  for  the  MMS. 

It  is  essential  and  helpful  to  recognize  that  most  regulatory 
safety  management  systems  have  been  dictated  and  established  in 
accordance  with  statutes,  which  have  in  turn  normally  been  generated 
by  some  specific  and  limited  incident  or  situation.  For  this  reason, 
the  systems  have  seldom  been  created  with  the  initial  purpose  of 
addressing  safety  from  a  broad  perspective. 

At  the  same  time  these  regulatory  activities  have  been 
developing,  there  have  been  numerous  students  and  investigators 
interested  in  safety,  and  how  to  achieve  it.  They  have  produced  a 


large  body  of  literature  and  have  shed  considerable  light  on  the 
subject  of  safety  and  safety  management.  Th~  professional  groups  most 
active  in  engineering  safety  include:  the  American  Society  of  Safety 
Engineers,  the  System  Safety  Society,  the  National  Safety  Management 
Society,  and  the  Human  Factors  Society.  These  organizations  and  their 
members  wrestle  with  the  problem  of  establishing  safety  or  a  safe 
working  environment  in  a  plant,  corporation,  or  other  organization. 

The  demands  of  government  oversight  of  safety  have  not  received  as 
much  attention.  Nevertheless,  much  of  the  available  information  is 
useful  and  applicable  to  the  regulatory  process. 

The  oldest  group,  the  American  Society  of  Safety  Engineers, 
founded  in  1911  is  concerned  with:  the  ratio  existing  between  major 
accidents,  minor  accidents,  and  incidents  or  near  misses;  the  need  for 
top  management  interest  in  safety;  the  need  to  train  people;  and  the 
need  for  engineering  safeguards.  The  National  Safety  Management 
Society,  chartered  in  1966,  espouses  that:  safety  is  not  just 
engineering,  it  is  a  function  of  and  must  be  integrated  into  manage¬ 
ment  practices;  safety  efforts  should  improve  productivity  as  well  as 
create  a  condition  free  of  accidents;  and  safety  results  from  good 
management  and  is  inherent  in  proper  management. 

Principles  of  system  safety,  promoted  by  the  Systems  Safety 
Society,  chartered  in  1954,  include  the  need:  to  consider  the  total 
system  including  man,  the  machine,  and  the  environment  or  surroundings 
in  achieving  safety;  to  identify  and  analyze  incidents  or  near  misses 
as  well  as  actual  accidents;  to  identify  and  systematically  eliminate 
hazards;  and  to  keep  in  mind  the  individual  and  the  surroundings  while 
engineering  the  equipment. 

The  Human  Factors  Society,  incorporated  in  its  present  form  in 
1964,  concentrates  on  the  necessity  of  dealing  with  the  human  part  of 
the  safety  equation.  This  applies  to  the  level  of  performance  of 
managerial  personnel  as  well  as  the  workman  on  site. 


ELEMENTS  OF  SAFETY  MANAGEMENT 

The  various  philosophies  of  safety  that  have  been  summarized  above 
make  it  evident  that  numerous  elements  are  important  in  safety 
management.  Following  is  a  compilation  and  description  of  the 
elements  of  safety  management.  Table  A-l  provides  a  summary  of  the 
elements  of  potential  interest  in  a  safety  management  system. 


Guidance 

All  systems  need  guidance,  whether  provided  by  humans  or  by  some 
mechanical  means  such  as  a  computer.  In  most  safety  systems,  the 
issues  and  problems  are  complex  enough  to  require  human  guidance. 
Guidance  encompasses  goal  and  priority  setting,  the  scoping  of  safety 
efforts,  and  the  developing  of  strategies  for  achieving  safety  goals. 


TABLE  A-l  Elements  of  a  Safety  Management  System 


Guidance 

o  Setting  priorities 
o  Establishing  goals 
long  term 
short  term 

o  Defining  scope  of  system 
o  Developing  strategy 

Attitude  Development 

Hazard  Identification  and  Analysis 

Safety  Planning 

o  Engineering  (related  primarily  to  hardware) 
reliability 

human  factors  (ergonomics) 
quality  assurance 
o  Operational 
o  Training 

Development  of  Safety-Related  Requirements 

o  Engineering  (related  primarily  to  hardware) 
o  Operational 
o  Training 

Accident/Incident  Investigation 

Information  System,  Including  Information  Analysis 

Resolution  of  Perceived  Hazards 

Safety  Communications 

Emergency  Procedures 
o  Plans 

o  Organizations  and  equipment 
o  Medical  services 

Enforcement 

o  Inspection 
o  Safety  audit 
o  Penalties 


Safety  Hotline/Advocate 
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Attitude  Development 

The  development  of  a  high  degree  of  interest,  belief  in,  and  awareness 
of  safety  among  all  of  the  persons  involved  is  universally  recognized 
as  an  important  element  in  most  successful  safety  programs.  It  is 
because  of  this  that  most  safety  professionals  believe  that  safety 
must  start  at  the  highest  levels  of  management  and  work  its  way  down¬ 
ward.  The  means  of  achieving  such  attitudes  throughout  an  organization 
vary  with  the  size  and  type  of  the  organization.  In  one  case  the 
attitude  may  be  the  product  of  one  man's  efforts;  in  another  instance, 
sophisticated  communications  programs  may  be  developed  to  engender 
safety  consciousness. 


Hazard  Identification  and  Analysis 

Hazard  identification  and  analysis  is  a  function  inherent  in  most 
safety  programs  within  any  form  of  organization  trying  to  develop  a 
safe  condition.  It  can  involve  everything  from  failure  mode  and 
effect  analysis  to  fault  tree  analysis  to  field  inspections  to 
analytical  studies.  Whatever  the  means,  the  objective  is  to  identify 
problem  areas  so  that  they  can  be  eliminated  before  an  unplanned  or 
unexpected  incident  occurs.  Best's  Loss  Control  Manual  and  Best's 
Underwriting  Guide  are  examples  of  compilations,  through  past 
experience,  of  various  potential  hazards  which  may  exist  in  a  wide 
variety  of  commercial  activities.  Such  information  can  be  used  in 
identifying  and  analyzing  hazards  in  an  organization  and  system  to 
minimize  unplanned  events. 


Safety  Planning 

Safety  planning  covers  such  activities  as  staff  efforts  to  consider 
and  initiate  precautionary  safety-related  efforts  in  the  areas  of 
engineering,  human  factors  (ergonomics),  and  quality  assurance. 

Safety  planning  may  include  efforts  to  influence  hardware  reliability. 
The  planning  element  also  encompasses  the  development  of  operational 
procedures,  and  requirements  for  operational  and  technical  training. 


Development  of  Safety-Related  Requirements 

This  element  is  related  to  the  development  and  promulgation  of  minimal 
standards  and  rules  within  the  scope  of  the  system.  As  with  safety 
planning,  this  element  addresses  engineering,  operational  procedures, 
and  training.  In  the  area  of  engineering,  it  addresses  the  development 
of  minimal  standards  for  hardware  and  for  the  computer-related  software 
used  in  controlling  the  hardware.  This  could  be  the  appropriate 
element  to  address  the  BAST  (Best  and  Safest  Technology)  concept 
required  by  statute. 


Under  the  area  of  operational  procedures,  the  requirements 
development  might  address  such  matters  as  intervals  for  checks, 
testing,  emergency  drills,  length  of  work  periods,  and  other  matters 
where  human  functions  and  tasks  are  involved.  In  the  matter  of 
training,  this  development  would  be  concerned  with  minimal  levels  and 
topics  of  training.  Such  minimal  training  concepts  already  have  been 
applied  in  various  ways  by  regulatory  bodies.  A  further  extension  of 
this  part  of  the  element  might  involve  personal  certification  and/or 
licensing  to  insure  minimal  training. 

Accident/Incident  Investigation 

This  element  concerns  the  investigation  and  analysis  of  accidents  and 
near  misses  (i.e.,  incidents)  so  that  measures  can  be  taken  to  insure 
that  similar  incidents  do  not  recur. 


Information  System 

This  element  is,  in  a  sense,  a  specialized  library  to  serve  the 
management  system  under  consideration.  An  information  system  might  be 
designed  to  acquire,  organize,  store,  and  retrieve  information.  It 
also  could  be  designed  to  analyze  and  distribute  the  data  in  the 
system. 

The  system  could  be  designed  to  handle  and  store  technical 
papers,  technical  specifications,  reports  of  accidents  or  incidents, 
plans,  written  or  graphic  compilations  of  deficiencies,  and  administra¬ 
tive  data,  such  as  status  of  reports,  inspections,  and  operations. 

A  safety  information  system  could  be  developed  in  two  general 
ways.  It  could  be  customized  very  specifically  to  meet  the  needs  of  a 
particular  situation  or  task,  or,  it  could  be  designed  more  generally 
to  cover  both  present  and  foreseeable  needs.  The  first  approach  has 
the  obvious  advantage  of  economy  while  the  second  is  more  flexible  and 
adaptable  to  changing  conditions. 

Resolution  of  Perceived  Hazards 

This  element  involves  the  function  of  monitoring  or  tracking  what 
happens  after  a  specific  hazard  is  identified,  either  through  some 
form  of  analysis  and  direct  observation,  or  through  investigation  of 
an  actual  accident  or  incident.  Normally  such  perception  would  be 
followed  by  some  form  of  recommendation  or  safety  requirement.  This 
element  insures  that  the  effects  of  the  changes  are  noted,  and  that 
potential  negative  effects  of  hazards  are  eliminated  or  neutralized. 

In  any  given  organization  or  system,  this  function  could  be  combined 
with  the  unit  doing  safety  information  analysis  or  safety  planning,  or 
with  the  guidance  element. 


Safety  Communications 


The  importance  of  good  communications  between  people  and  organizations 
involved  within  the  scope  of  the  system  is  self-evident.  Numerous 
forms  of  communication  may  be  involved  including  various  reporting 
formSi  correspondence,  and  formal  directives  or  releases.  Much  of  the 
communication  will  occur  as  the  result  of  project  administration,  but 
safety  communications  must  be  formally  considered  so  that  communi¬ 
cations  do  not  end  up  being  one  way.  It  serves  no  purpose  to  gather 
and  process  information  if  the  conclusions  and  lessons  learned  become 
buried  in  the  system.  Effective  communications  throughout  the  system 
is  essential. 


Enforcement  -  Safety  Audit 

Checking  and  auditing  is  necessary  to  insure  that  safety  standards  or 
requirements  are  being  observed  or  met.  In  some  systems  the  enforce¬ 
ment  function  is  related  directly  to  the  promulgation  of  standards  or 
requirements.  Infractions  of  the  rules  are  often  detected  through 
safety  inspections  which  focus  on  compliance  or  noncompliance  with 
specific  standards.  However,  many  organizations  are  conducting  audits 
of  operations.  The  implication  of  an  audit  is  one  of  taking  a  broad 
look  at  all  operations  and  all  phases  of  an  activity  to  detect  problems 
or  anomalies. 

A  safety  audit  might  well  detect  potentially  dangerous  situations 
which  might  not  be  controlled  by  any  specific  safety  requirement,  and 
are  to  some  extent  by  industry.  However,  current  OCS  statutes  rely  on 
facility  inspections  for  enforcement.  Audits  are  complementary  to 
inspections  and  would  be  beneficial  to  evaluating  the  overall  safety 
situation,  while  simultaneously  monitoring  compliance  with  specific 
safety  requirements. 

Emergency  Procedures 

All  safety  professionals  recognize  that  perfection  is  a  goal  seldom 
attained.  Therefore  safety  systems  have  to  provide  for  control  of 
losses  in  the  event  of  unplanned  events.  This  element  must  be 
addressed  whether  the  safety  management  system  serves  an  organization 
or  a  regulatory  safety  system.  In  the  former  case,  the  safety 
management  system  would  primarily  establish  and  control  emergency 
procedures,  while  in  the  latter  case  this  element  would  be  more 
involved  in  determining  and  specifying  the  level  and  kinds  of 
emergency  activities  needed,  and  who  will  provide  them. 

Safety  Ombudsman  Task 

This  clement  has  received  relatively  little  recognition  in  most  safety 
circles.  It  is  mentioned  in  one  study  of  the  Three  Mile  Island 
Nuclear  Accident  (Miller,  1979).  The  element  relates  to  the  fact  that 
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information  about  valid  safety  considerations  can  often  be  inhibited 
by  on-the-job  relationships  and  pressures.  The  idea  of  providing  an 
unrestricted  or  unfettered  channel  for  either  internal  or  external 
communications  on  safety-related  matters  through  the  ombudsman  concept 

is  worth  considering  in  the  design  of  any  safety  management  system.  ~  #  ( 

This  concept  may  be  particularly  important  in  a  regulatory  body  as  an 
alternative  to  an  adversarial  relationship  between  the  government  and 
industry. 


CONSIDERATIONS  IN  THE  DESIGN  OF  A  SAFETY  MANAGEMENT  SYSTEM 

The  recovery  of  offshore  oil  and  gas  involves  a  multitude  of  diverse 
activities,  tasks,  people,  and  organizations.  These  are  brought 
together  through  different  forms  of  contractual  relationships  so  that 
legal  considerations  often  become  a  significant  factor  in  achieving 
safety.  This  is  not  unheard  of  in  other  industrial  situations,  but  it 
becomes  a  far  more  significant  force  in  the  offshore  industry  because 
of  the  large  number  of  organizations  present  in  a  confined  area,  and 
because  of  the  different  and  relatively  liberal  theories  encountered 
in  maritime  law. 

Most  safety  activities  have  related  to  attempts  to  control  or 
influence  one  of  the  three  interrelated  areas  of  system  safety  —  man, 
machine,  and  the  environment.  While  it  is  possible  to  control  some 
limited  aspects  of  the  environment  for  specific  tasks,  the  general 
environment  surrounding  offshore  activities  is  not  readily  controlled. 
Historically,  most  safety  efforts  have  been  directed  at  the  machine: 
engineering  skills  have  been  used  to  make  the  machine  or  hardware  as 
reliable,  dependable,  and  trouble-free  as  possible. 

While  these  efforts  have  often  met  with  considerable  success, 
they  have  not  eliminated  accidents.  The  Federal  Aviation  Administra¬ 
tion's  (FAA)  licensing  system  for  pilots  of  aircraft,  the  U.S.  Coast 
Guard  licensing  systems  for  ship's  officers,  and  the  licensing  of 
plumbers,  electricians,  and  other  critical  trades  by  municipalities, 
are  examples  of  attempts  to  control  man  in  the  safety  equation.  These 
attempts  also  generally  show  a  degree  of  success.  Overall,  however, 
society  has  been  much  slower  to  sanction  the  control  of  "man"  than 
they  have  the  "machine",  and  such  controls  have  only  been  permitted 
where  the  lack  of  control  would  lead  to  highly  unacceptable 
consequences . 

More  attention  needs  to  be  paid  to  the  "man"  or  "people"  area  to 
improve  safety.  One  of  the  early  authors  on  safety  stated,  "All  acci¬ 
dents,  no  matter  how  minor,  are  the  fault  of  organization  (Heinrich, 
1959).  A  recent  safety  assessment  stated,  "Any  regulatory  or  standard 
setting  activity  is  only  part  of  the  safety  equation.  —  The  bottom 
line  in  safety  is  the  degree  of  care  exercised  by  individuals" 
(Bruggink,  1980).  These  statements  do  not  exist  only  in  theory.  A 
variety  of  safety  statistics  indicate  that  the  majority  of  all  acci¬ 
dents  are  caused  by  human  error,  poor  judgment,  lack  of  skills  or 
experience,  or  other  human  flaws.  Only  a  fraction  are  caused  solely 
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by  equipment  or  hardware  failure.  Of  these,  some  can  be  related  to 
improper  design  or  selection  of  inadequate  hardware  —  which  again 
reflects  human  failure.  These  general  statistics  are  corroborated  by 
studies  of  OCS  accidents  (Whitney,  1981). 

A  recent  study  of  the  costs  and  benefits  of  MMS  regulations 
(Arthur  D.  Little,  1982)  concluded  that  the  costs  expended  by  industry 
in  complying  with  MMS  regulations  amounted  to  1  to  4  percent  of  the 
cost  of  production.  The  study  team  also  found  indications  that  the 
MMS  regulations  have  not  contributed  significantly  to  reducing 
operational  risks.  Other  relevant  study  findings  were: 

o  The  investigators  were  unable  to  tell  if  the  large  body  of 
regulatory  requirements  now  in  effect  are  cost  effective; 

o  The  effect  of  using  experienced  employees  is  a  reduction  in 
the  probability  of  people  injury; 

o  Considerable  overlap  occurs  between  rules  which  require 

essentially  good  management  practices  and  those  which  require 
"safe"  practices;  and 

o  Regulations  that  mandate  good  engineering  practice  are  most 
effective  and  the  least  time  consuming  while  those  requiring 
extensive  reporting  and  planning  are  least  effective. 

Irrespective  of  the  results  of  the  benefit-cost  study,  a  well-managed 
and  more  efficient  system  is  likely  to  be  more  effective. 

Another  factor  that  must  be  considered  in  the  design  of  an  overall 
safety  management  system  is  that  all  personnel  accident  statistics 
consistently  show  that  of  all  reported  injuries,  between  20  percent 
and  33  percent  relate  to  back  injuries.  Safety  professionals  usually 
estimate  that  25  percent  or  more  of  injuries  are  back  related.  Many 
such  injuries  cannot  be  eliminated  by  conventional  safety  engineering 
activity.  In  a  plant  where  workers  perform  highly  repetitious  activi¬ 
ties,  safety  engineering  can  often  improve  or  eliminate  material 
handling  tasks  which  strain  the  back.  However,  most  heavy  industries 
involving  construction  and  other  non-repetitive  tasks,  such  as  offshore 
oil  and  gas  operations,  have  high  incidence  of  back  injuries.  It 
follows,  that  to  impact  this  large  portion  of  the  personnel  injuries, 
attention  will  have  to  be  given  to  the  person  who  is  involved. 

Training  aimed  specifically  at  reducing  back-related  injuries  may  be 
necessary. 


GENERAL  STRATEGIES  OF  SAFETY  MANAGEMENT 

It  is  useful  to  consider  the  strategies  available  to  a  regulator 
in  achieving  safety  in  a  regulated  industry  or  organization. 
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Some  of  the  older  traditional  regulatory  efforts  have  been 
directed  at  the  licensing  of  personnel,  or  control  of  the  human 
element.  Since  these  methods  have  achieved  some  success,  they  might 
be  retained  in  whole  or  in  part.  However,  there  has  been  little 
effort  to  control  the  upper  levels  of  the  human  problem,  i.e., 
management . 

If  safety  is  an  inherent  part  of  good  management,  then  the 
regulatory  body  should  be  looking  closely  at  the  management  of  the 
organizations  which  it  is  regulating.  The  elements  of  a  safety 
management  system  in  Table  A-l  might  be  used  as  a  guide  in  evaluating 
the  management  of  a  regulated  operation.  If  the  management  being 
regulated  is  addressing  a  majority  of  those  elements,  even  though  not 
by  the  same  name  it  might  be  assumed  that  the  regulated  organization 
at  least  has  a  start  on  providing  safe  working  conditions.  They  may 
need  help  or  advice  on  the  details,  but  are  headed  in  the  right 
general  direction.  If  however,  the  regulated  management  is  missing  or 
ignoring  most  of  the  elements,  then  no  amount  of  detailed  information 
or  help  on  engineering,  personnel  safety,  or  hazard  identification  is 
going  to  make  much  difference.  In  such  cases,  it  is  management  itself 
which  must  be  changed. 

Further,  a  positive  safety  attitude  throughout  an  organization  is 
fundamental,  and  such  an  attitude  cannot  exist  without  management 
approval.  With  this  in  mind  it  appears  reasonable  to  believe  that  one 
of  the  more  fundamental  methods  of  regulating  safety  involves  the 
evaluation  of,  and  where  necessary,  the  changing  of  the  management 
being  regulated,  it  is  necessary,  however,  to  have  an  objective  means 
of  evaluating  management.  Since  the  concern  is  safety,  an  information 
system  is  needed  to  gather  reliable  data  on  safety,  specifically  on 
Che  number  of  accidents  or  incidents  occurring  w?chin  the  sphere  of 
individual  regulated  managements. 

The  Coast  Guard  is  taking  a  major  step  in  establishing  such  an 
information  system  related  to  their  own  areas  of  regulatory  interest, 
with  the  specific  intent  of  focusing  their  efforts  on  poorly  performing 
management.  The  extension  of  this  system,  or  development  of  a  parallel 
system,  might  well  be  useful  to  the  Minerals  Management  Service  and 
other  governmental  agencies  with  responsibilities  in  offshore  safety, 
as  a  means  of  evaluating  management.  The  present  proposed  Coast  Guard 
system  does  not  include  the  collection  of  population  or  rate  data. 

This  is  a  deficiency  which  needs  to  be  remedied  to  provide  an 
objective  measure  of  management  performance  —  in  the  area  of  safety. 

It  is  worth  reviewing  the  regulatory  efforts  involving  control  of 
hardware.  The  present  MMS  regulations  tend  to  require  certain  general 
types  of  hardware,  equipment,  and  systems  under  given  circumstances. 
During  MMS  plan  reviews  and  during  offshore  physical  inspections, 
checks  are  made  to  insure  compliance.  The  regulations  are  relatively 
detailed  as  to  the  installation  and  testing  of  systems.  They  also 
have  special  provisions  for  the  extraction  of  sulphur,  as  opposed  to 
oil  and  gas.  If  future  operations  should  develop  involving  the 
recovery  of  other  minerals,  utilizing  different  kinds  of  technology 


and  equipment,  the  present  regulatory  requirements  would  have  to  be 
augmented  to  address  the  hardware  requirements  of  the  technology 
involved.  Thus,  with  the  hardware  approach  to  offshore  safety,  it  is 
relatively  certain  that  the  expense  of  regulatory  effort  will  continue 
to  increase  as  the  amount  and  types  of  offshore  activity  increase. 

Reviewing  the  regulatory  attempts  to  control  the  human  element 
reveals  that  relatively  few  offshore  personnel  are  licensed  or  certi¬ 
fied.  Those  that  are  include  the  aircraft/helicopter  pilots  and  a 
very  limited  number  of  ship/boat  operators  and  officers.  In  addition 
to  these,  crane  operators  must  meet  minimal  qualifications.  Those 
with  responsibility  for  well  control  must  satisfy  minimum  training 
requirements,  as  must  those  who  service  certain  critical  valves. 

While  these  requiremments  are  important,  they  do  not  address 
numerous  other  areas  important  to  the  general  safety  of  the  environ¬ 
ment,  personnel,  and  equipment.  None  of  the  existing  regulations  or 
requirements  address  the  problem  of  minimal  training/qualifications 
for  the  management  level  personnel  making  the  decisions  critical  to 
offshore  safety. 

Although  the  oil  and  gas  industry  is  generally  recognized  as 
having  a  very  high  degree  of  technical  competence,  this  does  not 
automatically  insure  that  those  individuals  who  directly  control 
offshore  operations  are  technically  qualified  or  knowledgeable  in 
safety  management.  One  cannot  manage  what  one  does  not  understand. 
This  was  a  fundamental  weakness  found  in  the  review  of  the  Three  Mile 
Island  nuclear  accident  (Miller,  1979). 

Another  regulatory  strategy  relies  on  industry  consensus  standard 
as  a  tool  in  requiring  certain  minimum  levels  of  hardware,  or  of  per¬ 
sonnel  performance  (Gerwick,  1982).  Consensus  standards  vary  widely 
in  content  and  purpose.  Those  addressing  technologies  may  be  quite 
specific  and  direct;  those  involving  people  and  prescribing  procedures 
less  so.  There  are  several  advantages  to  this  strategy.  Consensus 
standards  provide  the  regulatory  body  with  a  technical  reference  which 
can  be  updated  without  rewriting  the  regulation.  The  regulations 
permit  some  flexibility  as  long  as  the  standards  are  met. 

To  summarize  the  above  observations  covering  the  strategies  of 
safety  management  available  to  a  regulatory  body,  it  is  apparent  that 
regulatory  requirements  for  hardware  are  sometimes  useful  and  workable 
i.e.,  they  contribute  to  safety.  Also,  regulatory  requirements  involv 
ing  personnel  are  useful  but  have  been  used  in  the  offshore  oil  and 
gas  activities  in  a  relatively  limited  manner.  Further,  such  "people" 
requirements  as  do  exist  refer  mostly  to  workers,  rather  than  to 
managers.  The  application  of  minimum  requirements  for  training,  knowl 
edge,  and  performance  at  a  managerial  level  could  have  a  potentially 
more  powerful  effect  on  the  regulated  activity,  than  simply  expanding 
the  present  limited  regulations  directed  at  the  workmen. 


A  SAFETY  MANAGEMENT  SYSTEM  FOR  THE  MINERALS  MANAGEMENT  SERVICE 


This  section  considers  the  various  identified  elements  of  a  safety 
management  system  in  light  of  the  specific  responsibilities  of  the 
Minerals  Management  Service  to  manage,  enhance,  and  regulate  safety  on 
the  outer  continental  shelf.  Figure  2  charts  the  existing  flow  of  OCS 
safety  information  in  the  MMS.  It  is  easy  to  recognize  that  the  chart 
contains  some  of  the  functions  and  activities  which  have  previously 
been  identified  as  elements  in  a  safety  management  system.  For 
example,  the  "Enforcement  and  Inspection"  block  can  be  identified  with 
the  elements:  Safety-Related  Requirements  and  Enforcement  Safety 
Audit .  The  "Investigations"  block  can  be  related  to  the  element: 
Accident/Incident  Investigation.  The  "Safety  Information  Analysis  and 
Utilization"  block  could  be  identified  with  the  elements:  Hazard 
Identification  and  Analysis  and  Safety  Planning.  The  elements  of 
Attitude  Development  and  Emergency  Procedures  cannot  be  as  easily 
located  on  the  flow  chart. 

Since  Figure  2  contains  a  number  of  the  previously  identified 
elements  of  a  safety  management  system,  it  is  possible  to  augment  it 
with  some  of  the  missing  elements  to  produce  a  flow  diagram  for  safety 
information  appropriate  to  a  regulatory  process.  Figure  3  contains 
most  of  the  elements  of  a  safety  management  system.  Several  elements 
of  safety  management  systems  still  do  not  appear  on  Figure  3.  The 
Guidance  element  is  conspicuous  by  its  absence.  Another  element, 
Resolution  of  Perceived  Hazards  also  is  not  shown.  This  latter  element 
is  essentially  a  monitoring  process  to  insure  that  any  identified  pos¬ 
sible  or  probable  hazards  are  properly  resolved,  handled,  controlled, 
or  rejected  as  not  pertinent.  It  seems  reasonable  that  this  monitoring 
or  control  process  be  combined  with  or  included  in  the  element  of 
"Guidance."  It  is  possible  to  represent  this  combined  guidance  func¬ 
tion  on  the  flow  chart  diagram  by  placing  a  circle  near  the  center  of 
the  regulatory  functional  blocks  and  showing  a  control  line  to  each 
functional  block  indicating  a  central  control  function.  The  circle 
could  be  labeled  "Guidance"  with  a  subelement,  "Resolution  of  Perceived 
Hazards."  However,  the  flow  chart  of  Figure  3  is  already  complex. 

There  is  little  to  be  gained  by  complicating  the  chart  further,  as 
long  as  it  is  recognized  that  these  functional  blocks  must  be  coordi¬ 
nated  and  controlled. 

While  Figure  3  contains  all  of  the  elements  of  a  safety  management 
system,  it  also  represents  a  significant  complication  of  the  existing 
safety  regulatory  system  which  might  well  result  in  additional  require¬ 
ments  and  reporting  demands  on  the  regulated  industry.  However, 
additional  control  directed  toward  the  management  of  the  regulated 
industry  could  possibly  permit  the  withdrawal  or  minimization  of  regu¬ 
latory  requirements.  It  could,  for  example,  reduce  the  plan  submission 
and  approvals  which  now  tend  to  substitute  governmental  management  for 
industry  control.  By  requiring  the  regulated  management  to  perform 
generally  recognized  good  management  functions,  the  regulatory  agency 
can  r-'duce  the  number  of  such  functions  which  it  is  attempting  to 
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FIGURE  2  Current  OCS  safety  information  flow  diagram. 
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carry  out  for  industry.  Whatever  changes  are  made,  it  is  important 
that  there  be  a  reasonably  smooth  and  understandable  transition,  to 
avoid  confusing  the  current  regulatory  process,  and  in  the  end  doing 
more  harm  than  good. 

If  such  changes  were  made,  the  OCS  safety  management  information 
flow  would  begin  to  look  like  Figure  4.  The  cross-hatched  areas  show 
activities  or  functions  which  might  be  minimized  or  eliminated  at  a 
later  date.  Figure  4  shows  a  change  in  semantics  from  "field 
inspections"  to  "field  audit"  to  indicate  a  change  in  emphasis  from 
detailed  hardware  inspection  to  an  audit  of  the  controls  and 
procedures  in  place  in  the  field. 

The  information  flow  charts  that  have  been  presented  are  not 
intended  to  be  organization  charts.  However,  they  enable  the  testing 
of  organization  charts  (and  proposed  reorganizations)  against  the 
elements  of  safety  management  systems  to  determine  coverage,  and  the 
optimum  use  of  available  personnel  and  resources  for  safety  management 
and  safety  information  management. 
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APPENDIX  B 


DESCRIPTION  AND  ASSESSMENT  OF  THE  MINERALS 
MANAGEMENT  SERVICE  SAFETY  PROGRAM  COMPONENTS 


The  committee  reviewed  the  authorities  and  activities  of  the  Minerals 
Management  Service  (MMS),  as  has  been  described.  From  this,  it 
identified  those  MMS  activities  which  it  considered  to  be  safety- 
related  (see  Table  B-l).  It  also  developed  guidelines  for  assessment 
of  the  various  program  components.  These  are  presented  in  Table  B-2. 
The  remainder  of  this  section  is  keyed  to  Table  B-l,  and  describes  and 
assesses  the  program  components. 
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TABLE  B-l  Minerals  Management  Service  Safety 

Program  Components 


1.0  Best  Available  and  Safest  Technology  (BAST) 

1.1  Technology  Assessment  and  Research  Program 

1.2  BAST  Program 

1.3  BAST  Certification  Requirement 
2.0  Exploration  and  Development 

2.1  Exploration  Plan,  Development  Plan,  and  Environmental  Report 

2.2  Oil  Spill  Contingency  Plan 

3.0  Platforms 

3.1  Verification  Program 

3.2  Verification  Documentation  Requirement 

3.3  Application  for  Installation  of  Platform 

3.4  Oceanographic,  Meteorological,  and  Performance  Data 

4.0  Drilling 

4.1  Application  for  Permit  to  Drill 

4.2  Evidence  of  Fitness  of  Drilling  Unit 

4.3  Shallow  Hazards  Survey 

4.4  Hydrogen  Sulfide  -(^S)  Plan 

4.5  Sundry  Notice 

4.6  Safety  of  Floating  Operations 

4.7  Critical  Operations  Plan 

4.8  Well  Control  Training  Program 

5.0  Production 

5.1  Safety  System  Design 

5.2  Simultaneous  Operations  plan 

5.3  Welding  Plan 

5.4  Quality  Assurance  Program 

5.5  Subsurface  Safety  Device  Records 

5.6  Surface  Safety  Device  Records 

5.7  Failure  Inventory  and  Reporting  System 

5.8  Erosion  Control  Report 

6.0  Pipelines 

6.1  Application  and  Data 
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TABLE  B-l  Minerals  Management  Service  Safety 
Program  Components  (cont'd) 


7.0  Enforcement 

7.1  Inspection 

7.2  Civil  Penalties 

8.0  Accidents 

8.1  Accident  Report 

8.2  Reports  of  Spills  of  Oil  and  Liquid  Pollutants 

8.3  Events  File 

8.4  Accident  Investigations 


TABLE  B-2  Guidelines  for  Assessing  Minerals  Management 
Service  Safety  Program  Components 


i 

Missions 

o  Motivate  industry  (i.e.,  leaseholders,  operators,  employers)  to 
conduct  operations  safely  (i.e.,  environment,  worker  safety, 

|  structural  safety). 

o  Monitor,  audit,  document,  and  publicize  safety  performance  (i.e., 
pollution,  structures  and  equipment,  leaseholders,  operators, 
employers,  workers). 

|  o  Foster  the  development  and  application  of  technology. 

o  Insure  that  inconsistent  or  duplicative  requirements  are  not 
imposed . 

Means  of  Fulfilling  Missions 

o  Require  that  (system)  safety  programs  and  plans  be  developed  and 
implemented  by  operators  and  employers. 

o  Utilize  performance  approach  to  regulation  (to  promote  technology 
development) . 

o  Establish  goals  for  safety  performance. 

o  Safety  performance  analysis  and  feedback  (e.g.,  investigate 
accidents,  publish  performance  records). 

o  Provide  incentives  (positive  and  negative)  to  operators  and 

employers  to  meet  safety  goals  and  improve  safety  performance. 

Programmatic  considerations 

o  Addresses  statutory  objectives 
o  Meets  a  clear  need 

o  Fills  a  gap  in  coverage 

o  Enforceable 
o  Makes  "the  record"  public 

o  Computerize  input/output ;  computer  updates;  interactive  data 
bases 

o  Timeliness 
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TABLE  B-2  Guidelines  for  Assessing  Minerals  Management 
Service  Safety  Program  Components  (cont'd) 


Systematic  considerations 

o  Not  redundant  or  burdensome 

o  Accessible  (user  friendly) 

o  Contributes  to  hazard  identification  or  resolution; 

identifies  cause 
o  Contributes  to  enforcement 

o  Analysis  and  utilization  of  safety  information  (feedback) 
o  Does  it  need  other  information  to  be  useful? 


•  4 


•  4 


•  « 


•  4 


66 


1.0  Best  Available  and  Safest  Technologies  (BAST) 

1.1  Technology  Assessment  and  Research  Program 

1.1.1  Objective :  To  provide  MMS  with  the  technological 
insight  needed  for  regulating  offshore  operations  and  for 
assuring  public  safety  and  pollution  prevention. 

1.1.2  Reference:  n.a. 

1.1.3  Description:  Technology  assessment  projects  are 
conducted  to  determine,  analyze,  and  compare  the 
state-of-the-art  practice  and  knowledge,  and  to  identify 
technology  gaps  or  possible  improvements  for  further  study: 
for  example,  assessment  of  the  technology  used  in  estimating 
the  quantity  of  hydrocarbons  lost  for  purposes  of  determining 
royalties  from  oil  and  gas  lost  during  a  blowout.  Research 
projects  are  undertaken  to  quantify  the  applicability  of 
technologies  to  MMS  operational  needs,  and  to  pursue  joint 
industry/government  technology  development  projects.  Generic 
research  categories  include  well  control,  oil  spill  contain¬ 
ment  and  cleanup,  structural  dynamics,  structural  inspection 
and  monitoring,  geotechnics,  ice  mechanics,  materials,  and 
risk  assessment. 

1.1.4  Use  Made  of  Item:  Projects  in  support  of  BAST 
program  objectives,  and  to  improve  MMS  operational 
capability. 

1.1.5  Assessment :  The  Technology  Assessment  and  Research 
Program  supports  and  fosters  the  development  and  application 
of  safety-related  requirements  technology.  Funds  are 
expended  toward  improving  the  knowledge  and  performance  of 
MMS  personnel  or  for  filling  gaps  in  research  which  are 
perceived  as  critical  to  safety.  This  effort  is  important 
to  support  the  BAST  program. 

1.2  Best  Available  and  Safest  Technologies  (BAST  Program) 

1.2.1  Objective :  To  ensure  the  application  of  technology 
in  the  form  of  equipment,  systems,  procedures,  and  trained 
workers  to  ensure  the  highest  degree  of  operating  safety  and 
reliability,  with  consideration  of  the  costs  involved. 

1.2.2  Description:  The  BAST  program  assesses  and  analyzes 
technology  needs.  It  provides  a  coordination  framework  for 
exchange  of  technology  information  among  MMS  personnel. 
Through  a  system  of  headquarters  and  field  committees, 
operational  problems  are  identified  and  targeted  for  tech¬ 
nology  assessment  and  possible  research.  The  committees 
also  strive  to  assure  that  OCS  regulations  reflect 
state-of-the-art  technology.  The  information  flowing 
through  these  committees  concerns  the  following: 
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o  Maintaining  familiarity  and  understanding  of 

state-of-the-art  technology,  technology  advances,  and 
technology  alternatives. 

o  Identifying  current  and  potential  problem  areas. 

o  Identifying  known  or  suspected  operational 
deficiencies. 

o  Pointing  out  the  need  for  new  or  revised  orders, 
standards,  or  regulations. 

1.2.3  Reference:  OCS  Order  No.  5,  Sec.  1;  Outer 
Continental  Shelf  Lands  Act  (OCSLA)  Sec.  21(b). 

1.2.4  Use  Made  of  Item:  See  above. 

1.2.5  Assessment :  See  1.3.5 

1.3  BAST  Certification  Requirement 

1.3.1  Objective :  To  determine  that  the  operator  is  using 
the  best  available  and  safest  technology  (BAST). 

1.3.2  Description:  The  lessee  is  required  to  state  that 
BAST  is  to  be  employed.  BAST  is  in  use  if  the  lessee 
adheres  in  all  respects  to  OCS  orders,  or  has  MMS  approval 
for  specific  items  of  noncompliance. 

1.3.3  Reference:  OCS  Order  No.  5,  Sec.  1. 

1.3.4  Use  Made  of  Item:  BAST  endorsements  are  included  in 
exploration  and  development  plans.  In  Alaska,  and  other 
cold  regions,  BAST  includes  evidence  that  equipment  and 
materials  are  suitable  for  operation  during  freezing 
conditions. 

1.3.5  Assessment :  The  BAST  program  and  certification 
requirement  address  the  missions  of  motivating  industry, 
monitoring  safety  performance,  and  fostering  the  development 
and  application  of  available  technology.  They  are  responsive 
to  the  1978  Amendments  to  OCSLA.  The  exchange  of  technical 
knowledge  within  MMS  is  appropriate  to  the  implementation  of 
the  BAST  requirement.  This  program  and  requirement  provide 
an  opportunity  for  MMS  to  foster  and  spread  the  newer, 
safer,  and  more  productive  technology  among  members  of  the 
industry,  particularly  the  smaller  operators. 
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2.0  Exploration  and  Development 

2.1  Exploration  Plan,  Development  and  Production  Plan,  and 
Environmental  Report 

2.1.1  Objective :  To  evaluate  the  environmental  and 
economic  impact  of  OCS  drilling  and  development. 

2.1.2  Description: 

Exploration  Plan  -  Identifies  potential  hydrocarbon 
accumulations  and  wells  to  be  drilled  to  evaluate  the 
accumulation  in  the  entire  leased  area.  Includes 
proposed  type  and  sequence  of  exploration  activities 
with  a  tentative  timetable  for  execution;  description 
of  drilling  vessel,  platform,  or  other  equipment  to 
be  attached  to  the  seabed  indicating  safety  and 
pollution  control  features;  types  of  geophysical 
equipment  to  be  used;  approximate  location  at  each 
proposed  exploratory  well;  and  current  structure  maps 
and  schematic  cross  sections. 

Development  and  Production  Plan  -  Provides  for  the 
effective  and  efficient  development  and  production  of 
all  known  accumulations  of  commercially  exploitable 
hydrocarbons.  Includes  description  of  the  specific 
work  to  be  performed;  description  of  drilling 
vessels,  platforms,  pipelines,  or  other  installations 
to  be  used ;  locations  and  depths  of  proposed  wells; 
geological  and  geographical  data;  description  of 
environmental  safeguards  and  safety  standards  to  be 
met;  and  expected  rate  of  development  and  production 
and  a  time  schedule  for  activities. 

Environmental  Report  -  Accompanies  exploration, 
development,  and  production  plans.  Provides 
information  for  assessing  the  direct  effects  on  the 
environment  as  a  result  of  implementing  the  plans. 
Includes  descriptions  of  the  preparation  for  and 
response  to  oil  spills,  disposal  of  wastes, 
meteorological  and  oceanographic  conditions, 
environmentally  sensitive  areas,  offshore  and 
land-based  operations,  and  requirements  for  land, 
labor,  material,  and  energy. 

2.1.3  Reference:  OCS  Order  No.  2,  Sec.  1.1,  and  30  CFR 
250.34. 


2.1.4  Use  Made  of  Items:  Plans  are  approved  in  writing  and 
filed  in  the  MMS  district  office.  All  operations  are 
conducted  under  the  provisions  of  approved  plans.  Plans 
also  provide  the  basis  for  state  findings  of  consistency 
with  state  coastal  zone  management  programs. 
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2.1.5  Assessment :  This  program  provides  a  broad  range  of 
administrative,  technical,  system-level  and  safety  data  to 
enable  an  evaluation  of  the  intended  effort.  The  program 
addresses  statutory  responsibilities  of  MM S,  and  the  need  to 
assess  the  environmental  and  safety  risks.  Development  of 
the  required  material  calls  for  a  system-level  approach  by 
the  operator  and  increases  the  probability  of  a  safe  and 
environmentally  sound  operation.  The  plans  and  reports 
address  the  problems  of  motivating  industry  and  monitoring 
and  documenting  safety  efforts. 

2.2  Oil  Spill  Contingency  Plan 

2.2.1  Objective :  Document  operator's  capability  to  respond 
to,  contain,  and  clean  up  oil  spills. 

2.2.2  Description:  The  plan  must  show  that  the 
lessee/operator  has  available  a  full  cleanup  and  removal 
inventory  and  is  able  to  commit  these  resources  in  the  event 
of  an  oil  spill.  The  plan  contains  a  description  of 
procedures,  personnel,  and  equipment  to  be  used  in 
reporting,  cleanup,  and  prevention  of  a  spread  of  any 
pollution.  The  plan  contains  provisions  to  assure  that  full 
resource  capability,  including  accessiblity  and  capability 
of  equipment  of  the  lessee/operator,  is  known  and  can  be 
committed  during  an  oil  spill. 

2.2.3  Reference :  OCS  Order  No.  7,  Sec.  3.2. 

2.2.4  Use  Made  of  Item:  The  lessee  is  required  to  submit 
an  Oil  Spill  Contingency  Plan  with  or  prior  to  submitting  an 
Exploration  Plan  or  a  Development  and  Production  Plan.  The 
plan  is  reviewed  and  approved  annually  by  the  district 
supervisor.  It  is  kept  on  file  in  the  regional  and  district 
offices. 

2.2.5  Assessment :  The  requirement  for  a  contingency  plan 
provides  a  means  of  requiring  managers  of  regulated  industry 
to  act  in  a  responsible  manner.  This  objective  could  also 
be  addressed  by  a  performance  standard. 


3.0  Platforms 

Fixed  and/or  bottom-founded  platforms  to  be  installed  on  the  OCS 
require  MMS  approval  of  design,  fabrication,  and  installation.  In 
addition,  mobile  structures  are  reviewed  to  ensure  that  they  have 
current  U.S.  Coast  Guard  or  other  appropriate  certification  and 
that  site-specif ic  conditions  have  been  met.  Platforms  installed 
in  the  Gulf  of  Mexico  in  less  than  122  meters  (400  feet)  of  water 


1 


•  • 


•  • 


are  subjected  to  technical  review  by  the  Platform/Pipeline  Unit 
of  the  Office  of  the  Regional  Supervisor,  Rules  and  Production, 
MMS.  Platforms  for  frontier  areas,  i.e.,  areas  with  unusual  or 
extreme  problems  of  environmental  conditions,  and  platforms  of 
unusual  design  and,  in  the  Gulf  of  Mexico,  in  water  depths 
greater  than  122  meters  (400  feet),  are  subjected  to  a  compre¬ 
hensive  platform  verification  program  and  requirement  to  ensure 
structural  integrity.  Procedures  for  platforms  requiring  the 
approval  of  the  MMS  regional  supervisor  are  described  in  item  3.1 
below.  The  platform  verification  program  is  presented  in  item 

3.2  below. 

3.1  Installations  Requiring  Approval  of  MMS  Supervisor 

3.1.1  Objective :  To  review  the  design  parameters  of  the 
structure  and  the  foundation,  including  soil  boring  analysis 
and  piling  design. 

3.1.2  Description:  Provides  supporting  technical 
engineering  information.  All  fixed  and  mobile  drilling 
units  must  be  able  to  withstand  the  oceanographic  and 
meteorological  conditions  for  the  proposed  area  of 
operations . 

3.1.3  Reference:  OCS  Order  No.  2,  Sec.  2.1,  and  OCS  Order 
No.  8,  Sec.  3.4. 

3.1.4  Use  Made  of  Item:  Approval  of  the  installation  plan 
includes  certification  of  a  registered,  professional, 
structural  or  civil  engineer.  The  application  is  approved 
in  writing.  A  copy  of  the  transmittal  letter  is  kept  in  the 
regional  office. 

3.1.5  Assessments :  This  program  provides  a  monitoring  of 
the  design  criteria  and  engineering  effort  which  has  been 
done  in  planning  a  new  fixed  structure.  This  has  some 
marginal  safety  application  in  that  it  documents  engineering 
effort,  but  it  does  little  to  validate  or  recheck  the 
initial  efforts  made  by  the  owner.  The  program  should  be 
questioned  as  to  how  much  this  function  adds  to  safety  of 
the  platforms. 

3.2  Platform  Verification 

3.2.1  Objective :  To  provide  assurance  of  the  structural 
integrity  of  fixed  platforms  through  design  review, 
especially  of  the  adequacy  of  design  criteria  and  the 
conformance  of  engineering  designs  to  criteria. 

3.2.2  Description:  Design  documentation  that  is  submitted 
for  review  and  approval  comprises  (1)  general  platform 
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information,  (2)  environmental  and  loading  informat  ion,  (3) 
foundation  information,  and  (4)  structural  information,  and 
includes  design  drawings  and  material  specifications  for 
primary  load-bearing  members  included  in  the  space-frame 
analysis,  the  certification  by  the  lessee,  and  the  name  of 
the  registered  professional  engineer.  Verification 
documentation  is  submitted  in  three  stages:  a  design 
verification  plan,  a  fabrication  verification  plan,  and  an 
installation  verification  plan.  Each  of  these  plans 
nominates  the  certified  verification  agent  (CVA),  details 
the  qualifications  of  the  CVA,  and  how  CVA  certification  is 
to  be  accomplished  at  each  phase. 

3.2.3  Reference :  OCS  Order  No.  8,  Sec.  3. 

3.2.4  Use  Made  of  Item:  The  design  plan  is  submitted  with 
or  subsequent  to  submittal  of  the  Exploration  Plan  or  the 
Development  and  Production  Plan.  The  verification  plans  are 
then  submitted  sequentially  prior  to  the  commencement  of 
each  phase  of  constructon  of  the  platform  (design, 
fabrication,  installation).  The  data  submitted  are  reviewed 
and  retained  by  the  Platform  Verification  Section.  The  data 
enables  the  regional  managers  to  review  and  critique 
proposed  structural  approaches  incorporated  in  exploration 
and  development  plans.  It  also  enables  the  managers  to 
insure  that  actual  platform  ins tal la t ions ,  major  structural 
modifications,  and  repairs  comply  with  these  plans  and  with 
good  engineering  practices. 

3.2.5  Assessment :  This  program  addresses  the  missions  of 
monitoring  safety  practices  and  motivating  industry  to 
operate  in  a  highly  responsible  manner.  The  program  is 
consistent  with  the  idea  of  using  qualified  third  party 
individuals  to  audit  and  check  the  design  of  new  structures. 
This  fosters  the  use  of  adequate  engineering  research  and 
design  practices,  and  discourages  short  cuts  and  skimping 
which  could  lead  to  accidents.  This  program  has  the 
potential  of  generating  significant  extra  costs  by 
essentially  increasing  the  engineering  costs  on  new  or 
state-of-the-art  designs.  Care  must  be  taken  to  insure  a 
high  degree  of  competence  in  the  third  party  verification 
agencies,  so  as  to  control  the  verification  costs. 

3.3  Oceanographic,  Meteorological,  and  Performance  Data 

3.3.1  Objective :  To  establish  environmental  criteria  for 
design  of  OCS  structures.  Design  criteria  are  approved 
based  on  evaluation  of  the  data.  Also,  the  data  are  used  to 
monitor  and  evaluate  the  performance  of  structures  under 
various  weather  and  ocean  conditions,  and  to  determine 
requirements  foi  air  quality  review. 


3.3.2  Description:  Where  such  information  is  not  readily 
available,  it  is  requested  by  the  district  supervisor.  When 
requested  to  do  so,  the  lessee  is  required  to  collect  and 
report  oceanographic,  meteorological,  and  performance  data 
during  the  period  of  operation. 

3.3.3  Reference:  OCS  Order  No.  2,  Sec.  2.4. 

3.3.4  Use  Made  of  Item:  See  Objective .  Copies  of  these 
reports  are  kept  in  the  regional  office. 

3.3.5  Assessment :  The  program  attempts  to  collect 
information  which  has  a  bearing  on  the  structural 
performance  and  safety  of  structures.  The  progam  tends  to 
assist  MMS  in  evaluating  new  installations,  and  to  this 
extent  may  be  worthwhile. 


Drilling 

4.1  Application  for  Permit  to  Drill,  Deepen,  or  Plug  Back  (Form 
9-3310. 


4.1.1  Objective :  For  the  district  supervisor  to  evaluate 
and  approve  the  proposed  operation  in  support  of  the  prior 
approved  Exploration  and  Development  Plans. 

4.1.2  Description:  Provides  supporting  technical  and 
engineering  information  about  drilling  operations  (see  item 

4.2  -  4.4). 

4.1.3  Reference:  OCS  Order  No.  2,  Sec.  1.2,  and  30  CFR 
250.36. 


4.1.4  Use  Made  of  Item:  Plans  are  approved  by  the  district 
supervisor  based  on  consistency  with  accepted  engineering 
practices.  Forms  and  supporting  information  are  in  the 
district  office. 

4.1.5  Assessment :  The  application,  with  supporting  data, 
is  a  significant  engineering/safety  milestone.  The 
requirement  to  furnish  supporting  data  can  be  viewed  as 
burdensome,  if  such  data  are  not  used  by  MMS;  alternatively, 
supporting  data  could  be  made  available  on  request. 

4.2  Evidence  of  Fitness  of  Drilling  Unit  to  Perform  the  Planned 

Operation 


4.2.1  Objective :  To  evaluate  the  capability  of  the 
drilling  rig  to  perform  the  planned  drilling  operation 
within  an  acceptable  margin  of  safety. 
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A. 2. 2  Description :  Evidence  of  the  fitness  of  a  drilling 
unit  to  perform  planned  operations  is  submitted  as  part  of 
the  Application  for  Permit  to  Drill  (APD)  (Form  9-331C). 

A. 2. 3  Reference :  OCS  Order  No.  2,  Sec.  2.2. 

A. 2. A  Use  Made  of  Item:  See  A.l. 

A. 2. 5  Assessment :  The  application  of  the  requirement  to 
fixed  platforms  is  appropriate.  There  is  some  question  as 
to  whether  application  of  the  requirement  to  mobile  offshore 
drilling  units  duplicates  engineering  reviews  done  during 
American  Bureau  of  Shipping  classification  or  Coast  Guard 
certification. 

A. 3  Shallow  Geologic  Hazards  Survey  Report  and  Data 

A. 3.1  Objective :  To  assist  in  preparing  (1)  an 
Environmental  Geologic  Report  for  inclusion  in  environmental 
assessments  of  proposed  lease  sales  and  (2)  a  Shallow 
Geologic  Hazards  Report  for  the  district  office  to  use  in 
APD  approval  or  disapproval. 

4.3.2  Description:  Included  as  part  of  the  APD  (Form 
9-331C). 


4.3.3  Reference :  OCS  Order  No.  2,  Sec.  2.3. 

4.3.4  Use  Made  of  Item:  Shallow  hazards  data  are  • 

circulated  as  appropriate  within  KMS  and  to  operators. 

The  plan  is  approved  in  writing.  A  copy  is  filed  at  the 
district  office. 

4.3.5  Assessment :  This  shallow  hazards  survey  is  used  by 

the  MMS  to  verify  any  conflicts  in  drilling  depths  that  • 

would  interfere  with  adjacent  drilling  areas.  Although  such 
conflicts  are  infrequent,  the  check  is  important  and  should 
be  retained. 

A. A  Hydrogen  Sulfide  (H2S)  Contingency  Plans 

4.4.1  Ob ject ive :  To  review  operations  for  safety  and  for 
compliance  with  regulations. 

A. A. 2  Description:  Drilling  operations  in  some  locations 
have  encountered  H2S  which  can  be  fatal  if  inhaled.  The 

plan  describes  preventive  measures  to  avoid  H2S  • 

emergencies,  and  operating  practices  in  the  event  of  them. 


A. A. 3  Reference :  OCS  Order  No.  2,  Sec.  8. 
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4.4.4  Use  Made  of  Item:  The  H2S  Contigency  Plan  is 
submitted  simultaneously  with  the  APD  (Form  9-331C)  for 
wells  to  be  drilled  in  potentially  I^S-prone  areas.  The 
plan  is  approved  along  with  Form  9-331C,  and  a  copy  is  kept 
on  file  in  the  district  office. 


4.4.5  Assessment :  Encounters  with  H2S  can  lead  to 
catastrophic  emergencies.  The  plan  clearly  documents  that 
the  lease  operator  has  considered  the  emergency  and 
developed  contingency  actions.  The  severity  of  the  hazard 
justifies  the  existence  of  the  requirement. 

4.5  Sundry  Notice  including  Abandonment  of  Wells  (Form  9-331) 

4.5.1  Objective :  To  determine  compliance  of  drilling 
production  operations  with  OCS  orders. 

4.5.2  Description :  Notices,  which  consist  of  technical  and 
engineering  descriptive  material  demonstrating  compliance 
with  OCS  orders,  are  filed  before  work  such  as  abandonment 
of  a  well  is  undertaken,  and  after  the  work  is  completed. 
Written  approval  of  Form  9-331  must  be  received  before 
operations  can  commence. 

4.5.3  Reference:  OCS  Order  No.  3,  Sec.  1,  and  30  CFR 
250.92(b)  (3)  (4). 


4.5.4  Use  Made  of  Item:  Sundry  notices  are  reviewed  to 
establish  the  type  of  work  proposed  and  compliance  with  OCS 
orders.  Sundry  notices  are  submitted  wih  an  original  and 
three  copies.  The  original  and  attachments  are  filed  in  the 
district  office,  one  copy  is  sent  to  the  MMS  regional 
office,  an  approved  copy  is  returned  to  the  operator,  and 
the  last  copy  is  for  public  record. 

4.5.5  Assessment :  Documentation  of  compliance  with  OCS 
orders  is  justified.  Alternatively,  such  documentation 
could  be  required  to  be  kept  by  the  operator  and  provided  to 
MMS  on  request. 


4.6  Program  Providing  for  Safety  of  Floating  Drilling  Operations 

4.6.1  Objective :  To  insure  safety  in  floating  drilling 
operations.  Operations  from  floating  drilling  vessels 
require  drilling  through  a  marine  riser  for  circulation  of 
drilling  fluids.  Formation  competency  at  shallow  depths 
sometimes  is  not  adequate  to  permit  circulation  to  the 
vessel.  Special  drilling  procedures  are  necessary  in  these 
situations. 


4.6.2  Description:  The  operator  must  submit  all  known 
pertinent  information  including  seismic  and  geologic  data, 
water  depth,  drilling-fluid  hydrostatic  pressure,  a 
schematic  diagram  indicating  the  equipment  to  be  installed 
from  the  rotary  table  to  the  proposed  conductor-casing  seat, 
and  a  contingency  plan  for  moving  off  location. 

4.6.3  Reference :  OCS  Order  No.  2,  Sec.  5.4.2. 

4.6.4  Use  Made  of  Item:  Programs  are  reviewed.  Copies  are 
maintained  in  the  regional  office. 

4.6.5  Assessment :  The  requirement  is  justified.  An 
alternative  means  of  achieving  the  objective  would  be  to 
require  that  operators  have  a  program  and  that  the  program 
be  made  available  to  the  MMS  on  request  for  review. 

4 . 7  Critical  Operations  and  Curtailment  Plan 


4.7.1  Objective :  To  review  operators'  policies  and 
procedures  for  handling  certain  operations  performed  during 
drilling  with  respect  to  well  control,  and  for  the 
prevention  of  fires,  explosions,  and  oil  spills.  These 
include  operations  such  as:  (1)  drill  stem  testing,  (2) 
setting  casing,  and  (3)  logging  or  wireline  operations. 

4.7.2  Description :  The  operator  identifies  the  specific 
critical  operations  likely  to  be  conducted  and  describes  the 
circumstances  or  conditions  under  which  these  operations 
will  be  ceased  or  limited.  The  operator  must  review  the 
plan  annually. 

4.7.3  Reference :  OCS  Order  No.  2,  Sec.  9. 

4.7.4  Use  Made  of  Item:  The  plan  is  submitted  with  the 
Exploration  Plan  or  Development  Plan.  It  is  reviewed  by 
district  drilling  engineers,  approved  by  the  district 
engineer,  and  kept  on  file  in  the  district  office. 

4.7.5  Assessment :  The  requirement  for  preparation  of 
advance  plans  to  cope  with  various  emergencies  is  valid  and 
addresses  safety  concerns.  The  requirement  for  submitting 
copies  of  the  plan  which  are  then  filed  raises  questions  as 
to  how  effective  the  program  is  in  implementing  safety.  An 
alternative  safety  strategy  would  require  that  plans  be 
prepared  and  made  available  to  MMS  on  request. 


4.8  Well  Control  Training  Program 
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A. 8.1  Objective :  To  provide  for  the  qualifications  of 
drilling  personnel  in  well-control  equipment,  operations, 
and  techniques  to  ensure  safety  and  to  prevent  pollution 
during  drilling  operations. 

4.8.2  Description:  Lessee  and  drilling  contractor 
personnel  must  be  trained  and  qualified  in  accordance  with 
MMS  standards.  MMS  approves  the  curricula  of  well  control 
training  schools.  Any  driller,  toolpusher,  or  operator's 
representative  who  was  trained  in  well  control  operations 
between  December  1,  1975,  and  December  1,  1979,  is  credited 
with  having  met  the  federal  training  requirements.  To 
maintain  qualification,  such  personnel  must  successfully 
complete  a  MMS-approved  refresher  course  annually  and  repeat 
the  basic  well-control  course  every  four  years. 

4.8.3  Reference :  OCS  Order  No.  2,  Sec.  7.3. 

4.8.4  Use  Made  of  Item:  Records  of  the  training  of 
personnel  are  maintained  at  the  drill  site. 

4.8.5  Assessment :  The  curriculum  approval  and  course 
attendance  requirements  motivate  industry  and  document  the 
training  (and  presumably  the  capability)  of  employees.  More 
vigorous  means  of  documenting  worker  capability  include  MMS 
review/criteria  of  student  performance  at  well  control 
schools;  and/or  on-the-job  tests  witnessed  by  MMS  inspectors. 


5.0  Production 

5.1  Submittal  of  Safety-System  Design  and  Installation  Features 

5.1.1  Objective :  To  determine  whether  production  safety 
system  facilities  are  in  compliance  with  OCS  orders  and 
American  Petroleum  Institute  (API)  recommended  practices. 

5.1.2  Description :  The  lessee  is  required  to  submit  and 
receive  district  approval  of  safety-system  design  features 
prior  to  their  installation.  Information  submitted  includes 
that  which  is  relative  to  design  and  installation  features 
of  all  surface-production  safety  systems  including  schematic 
floor  diagrams,  safety  analysis  function  evaluation  (SAFE) 
charts,  and  schematic  piping  diagrams.  A  required  element 
is  certification  that  the  designs  for  the  mechanical  and 
electrical  system  were  approved  by  registered  professional 
engineers . 

5.1.3  Reference :  OCS  Order  No.  5,  Sec.  4.4. 


•  « 


•  « 
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5.1.4  Use  Made  of  Item:  A  district  production  engineer 
reviews  the  information.  One  complete  set  of  the  submittal 
is  kept  in  the  district  office  for  reference.  A  second  set 
is  filed  in  the  regional  office.  A  production  technician 
may  make  an  on-site  inspection  to  verify  compliance  with 
approved  submittals. 

5.1.5  Assessment :  The  SAFE  chart  and  schematic  diagrams  of 
piping  are  key  safety  items,  which  require  MMS  approval,  and 
which  should  be  on  file  at  MMS.  Other  documentation 
accompanying  the  submittal  should  be  reviewed  from  the 
standpoint  of  requiring  that  documentation  be  made  available 
to  MMS  on  request. 

5.2  Simultaneous  Operation  Plan 

5.2.1  Objective :  To  provide  a  means  for  evaluating  safety 
and  compliance  with  OCS  orders  when  workover,  wireline, 
pumpdown,  and  major  construction  operations  are  to  be 
conducted  simultaneously  with  production. 

5.2.2  Description:  Prior  to  conducting  simultaneous 
operations,  a  plan  must  be  submitted  to  and  approved  by  the 
district  supervisor.  The  plan  includes  a  narrative 
description  of  operations  and  procedures  for  mitigating 
potentially  undesirable  events. 

5.2.3  Reference :  OCS  Order  No.  5,  Sec.  5.3 

5.2.4  Use  Made  of  Item:  The  plan  is  approved  in  writing 
and  filed  with  the  district  supervisor. 

5.2.5  Assessment :  The  potential  hazards  of  simultaneous 
operations  justify  this  requirement, 

5.3  Welding,  Burning,  and  Hot  Tapping  Plan 

5.3.1  Objective :  Enables  review  of  operations  for 
compliance  with  OCS  orders  and  industry-recommended 
practices . 

5.3.2  Description:  Each  lessee  is  required  to  file  a 
Welding,  Burning,  and  Hot  Tapping  Plan  with  the  district 
supervisor.  The  plan  must  contain  qualification  standards 
for  personnel  and  the  methods  by  which  the  lessee  will 
assure  that  only  qualified  personnel  are  used.  The  plan 
also  contains  a  drawing  to  identify  the  facility's  safe 
welding  areas.  All  welding  or  burning  not  done  in  a  safe 
welding  area  must  be  performed  in  accordance  with  certain 
procedures . 


•  < 
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5.3.3  Reference :  OCS  Order  No.  5,  Sec.  5.4  through  5.4.3. 

5.3.4  Use  Made  of  Item:  The  information  required  to  be 
submitted  as  a  part  of  this  plan  is  used  by  the  production 
engineer  to  review  the  proposed  operation  for  compliance 
with  OCS  Order  No.  5.  Maintenance  of  welding  plans  allows 
the  inspectors  to  monitor  for  compliance.  The  plans  are 
approved  in  writing  and  filed  in  the  district  office.  A 
copy  of  the  plan  is  to  be  available  in  the  field  area. 

5.3.5  Asssessment :  With  the  many  types  of  welding  and 
different  applications  of  welding  methods,  it  is  sufficient 
to  maintain  the  welding  plan  on  the  OCS  installation,  and  to 
make  it  available  for  MMS  review  on  request. 

5.4  Quality  Assurance  (QA)  Program 

5.4.1  Objective :  To  work  closely  with  the  American  Society 
of  Mechanical  Engineers  (ASME)  and  API  in  amending  standards 
or  developing  new  standards,  and  to  ensure  that  safety  and 
pollution  prevention  equipment  conform  to  quality  assurance 
standards  (ANSI/ASME-SSPE  1  and  SSPE  2). 

5.4.2  Description :  The  program  applies  to  the  installation 
of  surface  and  subsurface  safety  valves  on  offshore 
production  structures.  MMS  certifies  valve  manufacturers 
that  meet  ASME  and  API  standards.  Only  the  valves  of 
certified  manufacturers  can  be  used  by  lessees. 

5.4.3  Reference :  OCS  Order  No.  5,  Secs.  2  and  3. 

5.4.4  Use  Made  of  Item:  Operators  are  required  to  keep 
records  on  the  installation,  repair,  and  replacement  of 
surface  and  subsurface  safety  valves.  Records  are  checked 
during  inspections. 

5.4.5  Assessment :  The  program  verifies  that  equipment 
meets  standards,  and  fosters  reductions  in  manufacturing 
defects.  The  certification  by  the  operator  that  equipment 
under  the  program  meets  the  standards  of  the  program  is 
redundant  to  some  extent  with  the  certification  of  the 
equipment  manufacturer  that  its  products  meet  the  standard. 

5.5  Subsurface  Safety  Device  Records 

5.5.1  Objective :  To  verify  performance  of  key  safety 
devices. 

5.5.2  Description:  Records  on  installation,  maintenance, 
testing,  and  use  are  maintained  by  the  lessee  for  at  least  5 
years . 


•  4 


5.5.3  Reference :  OCS  Order  No.  5,  Sec.  3.11. 


5.5.4  Use  Made  of  Item.*  When  Che  Failure  Inventory  and 
Reporting  System  (FIRS)  (see  5.7)  was  in  place,  this 
information  was  used  as  a  check  on  FIRS  data.  Records  are 
available  for  MMS  inspection. 

5.5.5  Assessment :  The  importance  of  the  safety  devices 
merits  the  requirement.  The  provisions  of  the  requirement 
for  MMS  audit  versus  operator  submission  of  data  for  MMS 
filing  are  exemplary  and  may  provide  a  model  for  other  MMS 
documentation  requirements. 

5.6  Surface  Safety  Device  Records 

5.6.1  Objective :  To  verify  performance  of  key  safety 
devices . 


5.6.2  Description :  Records  of  installation,  maintenance, 
testing,  and  use  are  maintained  by  the  lessee  for  at  least  5 
years . 


5.6.3  Reference :  OCS  Order  No.  5,  Sec.  5.6  through  5.6.1. 

5.6.4  Use  Made  of  Item:  When  FIRS  (see  5.7)  was  in  place, 

this  information  was  used  as  a  check  on  FIRS  data.  Records 
are  available  for  MMS  inspection. 

5.6.5  Assessment :  See  5.5.5. 

5.7  Safety  Device  Failure  and  Inventory  Reporting  System  (defunct) 

5.7.1  Objective :  To  enhance  reliability  and  safety  through 

development  of  reliability  data  on  key  safety  devices. 

5.7.2  Description:  Periodic  inventory  and  failure  reports 
were  submitted  on  safety  and  pollution  prevention  devices  on 
offshore  structures,  including  satellites  and  jackets,  which 
produce  or  process  hydrocarbons,  and  the  hydrocarbon 
pipelines  thereon.  Devices  included  blowdown  valves,  burner 
flame  detectors,  check  valves,  combustible  gas  detectors, 
emergency  shutdown  valves,  level  sensors,  pressure  sensors, 
relief  valves,  shutdown  valves,  subsurface  safety  valves, 
surface  safety  valves,  temperature  sensors,  valve  actuators, 
and  shutdown  valves. 

5.7.3  Reference:  OCS  Order  No.  5,  Sec.  6.  Also  see 
cancellation  notice:  Federal  Register,  April  30,  1982. 
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5.7.4  Use  Made  of  Item:  The  program  was  cancelled  because 
it  involved  substantial  paperwork,  with  limited  usefulness. 
FIRS  data  were  intended  to  be  processed  for  subsequent 
safety  analysis,  with  industry-wide  dissemination  of  reli¬ 
ability  results,  but  the  program  never  attained  this  level 
of  implementation. 

5.7.5  Assessment :  Collection  and  dissemination  of 
reliability  data  foster  improvements  in  technology.  The 
FIRS  program  duplicated  industrial  efforts  in  that  companies 
normally  keep  records  of  safety  equipment  performance  for 
maintenance  and  other  purposes.  A  more  efficacious  involve¬ 
ment  of  the  MMS  in  reliability  would  be  the  conduct  of 
reliability  studies  using  available  industry  data  (see  also 

5.5  and  5.6) . 

5.8  Annual  Report  of  Wells  that  have  Erosion  Control  Problems 
and  Results  of  Erosion  Control  Programs 

5.8.1  Objective :  To  provide  the  MMS  regional  office  with 
information  necessary  to  evaluate  and  measure  the 
effectiveness  of  erosion  control  measures  and  compliance 
with  OCS  orders. 

5.8.2  Description:  Lessees  that  have  wells  or  fields 
having  a  history  of  sand  production  are  required  to  have  an 
erosion  control  program  in  effect  to  maintain  the  integrity 
or  safety  of  production  and  safety  systems.  The  program  may 
include  sand  probes,  X-ray,  ultrasonic,  or  other  satisfactory 
monitoring  methods. 

5.8.3  Reference :  OCS  Order  No.  5,  Sec.  5.1.11. 

5.8.4  Use  Made  of  Item:  The  reporting  requirement  provides 
a  study  of  the  results  of  erosion-control  programs.  Erosion 
control  annual  reports  are  reviewed  by  the  production 
engineer  and  chief  production  technician,  and  filed  in  the 
district  office.  The  annual  report  also  is  submitted  by 
December  to  the  appropriate  regional  office. 

5.8.5  Assessment :  This  program  monitors  a  safety-related 
matter  involving  the  integrity  and  safety  of  production 
equipment.  Requiring  an  erosion  control  program,  when  it  is 
appropriate,  is  valid.  However,  to  require  a  report  which 
is  reviewed  and  filed  adds  little  to  the  implementation  of 
safety. 


6.0  Pipelines 

6.1  Pipeline  Applications  and  Data 
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6.1.1  Objective :  To  review  the  conformance  to  applicable 
industry  standards  and  government  regulations,  and  for 
shallow  geologic  hazards. 

6.1.2  Description:  Data  and  engineering  specifications  and 
drawings  are  provided.  All  pipelines  are  designed  and 
maintained  according  to  specific  requirements. 

6.1.3  Reference :  OCS  order  No.  9,  Secs.  1  through  3. 

6.1.4  Use  Made  of  Item:  The  data  are  submitted  to  the 
district  supervisor  for  approval  as  a  letter  request  for 
right  of  use  and  easement.  Copies  are  maintained  in  the 
regional  office.  Hazards  data  are  kept  by  the  resource 
evaluation  group. 

6.1.5  Assessment :  Pipelines  must  be  constructed  and 
installed  according  to  various  government  and  industry 
standards.  This  program  should  be  reviewed  to  determine 
whether  portions  of  it  are  redundant  with  other  federal 
pipeline  reviews  and  approvals. 


7.0  Enforcement 

7.1  Inspection  Program 

7.1.1.  Objective :  To  insure  compliance  with  MMS 
regulations,  OCS  orders,  approved  plans,  and  other 
approvals;  to  enhance  operational  safety  and  to  minimize 
pollution. 

7.1.2  Descript  ion:  The  MMS  has  nine  districts,  including 
five  in  the  Gulf  of  Mexico,  which  oversee  95  percent  of  OCS 
field  operations.  The  OCSLA  requires  that  every  OCS 
facility  be  inspected  once  each  year.  These  announced 
inspections  are  completed  in  9  months  in  the  Gulf. 
Unannounced  inspections  are  conducted  in  the  remaining  3 
months.  In  frontier  areas,  inspections  are  conducted  more 
frequently.  In  some  instances,  MMS  inspectors  have  resided 
on  drill  rigs  during  drilling  operations. 

In  the  Gulf,  45  field  operations  inspectors  use  12 
helicopters  to  visit  the  2,850  platforms  annually.  It  may 
take  as  long  as  3  days  to  inspect  a  large  platform  or  as 
little  as  30  minutes  to  inspect  a  single  well  caisson. 

About  half  of  the  2,850  structures  in  the  Gulf  have  fewer 
than  six  wells. 

There  are  14  platforms  in  the  Pacific  Region  and  nine 
drilling  units.  Ten  inspectors  and  two  helicopters  are 
employed  in  field  inspections  in  the  Pacific  Region. 
Drilling  operations  are  visited  almost  every  day. 


In  Alaska,  inspectors  nay  reside  on  frontier  drilling 
operations.  At  the  peak  of  drilling  operations  in  the 
Atlantic,  three  inspectors  covered  the  area. 

The  objective  of  the  inspection  program  is  to  enhance 
operational  safety,  minimize  pollution,  and  ensure  that 
operating  rules  are  followed.  Inspection  includes  all 
safety  equipment  designed  to  prevent  or  ameliorate  blowouts, 
fires,  spillages,  or  other  major  accidents.  In  1982,  a 
total  of  7,000  site  visits  were  made  by  inspectors;  5,500 
citations,  or  INC  (Incidents  of  Noncompliance  with  Operating 
Orders)  were  issued  to  operators.  Most  INCs,  such  as  pilots 
out  of  tolerance,  are  easily  corrected.  Field  inspectors 
have  access  to  a  platform  inspection  data  base,  which 
contains  information  about  the  platform,  hours  spent 
inspecting,  violations,  departures  granted,  safety  device 
settings,  pipelines,  well  bay  operations,  production 
vessels,  and  possible  items  of  noncompliance.  The  data  base 
contains  settings  of  various  safety  devices  and  equipment, 
and  items  not  in  compliance  with  regulation.  The  data 
derive  from  prior  field  inspections. 

7.1.3  Reference :  A3  USC  13A8 

7.1. A  Use  Made  of  Item:  Inspections  are  conducted  by  means 
of  standard  checklists.  Copies  of  the  checklist  are  main¬ 
tained  by  the  MMS  and  are  provided  to  the  OCS  installation 
and  the  operator's  responsible  field  office.  Incidents  of 
noncompliance  and  potential  incidents  of  noncompliance  are 
noted,  followed  up  on,  and  provide  the  basis  for  enforcement 
actions  which  may  include  suspensions  in  operations  or  civil 
penalties  (see  item  7.2). 

7.1.5  Assessment :  The  inspection  program  meets  a  clear 
enforcement  need  and  contributes  to  safety  performance  by 
assuring  that  required  safety  equipment  is  installed  and 
procedures  used.  The  inspection  program  may  be  viewed  as  a 
negative  incentive  because  it  highlights  breaches  in 
performance,  rather  than  successes,  but  good  inspection 
records  could  also  be  used  in  a  motivational  framework  — 
letters  of  commendation  could  be  sent  to  good  performers,  or 
good  performers  could  be  inspected  less  frequently  than 
poorer  performers.  Copies  of  inspection  records  also  could 
be  sent  to  contractors  who,  in  drilling  especially,  may  play 
a  major  role.  The  inspection  data  base  could  be  modernized 
to  facilitate  identification  of  trends  in  the  performance  of 
structures  and  equipment. 


7.2  Penalties  Program 


7*2.1  Objective :  To  help  improve  the  safety  of  personnel 
and  equipment  engaged  in  OCS  oil  and  gas  operations,  to 
protect  the  quality  of  the  marine  environment,  and  to 
encourage  prompt  and  efficient  exploration  and  development. 

7.2.2  Description:  Oil  and  gas  operations  on  the  OCS  are 
to  be  conducted  m  accordance  with  applicable  federal  laws, 
regulations,  and  orders.  In  addition  to  criminal  penalties, 
the  MMS  can  further  prompt  operators,  lessees,  and  permittees 
to  comply  voluntarily  with  legal  requirements  through  civil 
penalties.  In  the  case  of  the  OCS  field  inspection  program, 
civil  penalties  may  be  imposed  when  traditional  enforcement 
actions  —  warnings  and  shut-in  orders  —  have  been  or  would 
be  ineffective.  In  other  matters,  civil  penalties  are 
imposed  only  after  the  violator  has  had  an  opportunity  to 
make  amends.  The  MMS  has  the  authority  to  assess  and 
collect  a  civil  penalty  of  not  more  than  $10,000  for  each 
day  of  noncompliance.  However,  the  MMS  is  required  to  give 
potential  violators  written  notice  prior  to  issuing  a 
citation. 

Following  is  an  account  of  civil  penalties  action  through 
1982. 


TABLE  1  Civil  Penalties  Actions 


1980 

1981 

1982 

Cases 

12 

12 

30 

Penalties  Assessed 

10 

9 

20 

Collected 

$394K 

$353K 

$388K 

SOURCE:  Minerals  Management  Service 


The  majority  of  these  penalty  actions  were  the  result  of  repeat 
INCs  as  the  result  of  inspection.  Very  few  cases  arise  solely 
on  the  basis  of  the  severity  of  a  violation.  A  1983  court 
ruling  voided  several  penalties  actions  on  the  grounds  that  MMS 
failed  to  give  potential  violators  sufficient  notice.  The  civil 
penalties  regulations  are  being  revised  in  accordance  with  the 
court  ruling.  The  civil  penalty  provisions  of  OCSLA  also  apply 
to  U.S.  Coast  Guard  regulations  under  the  OCSLA. 


7.2.5  Assessment :  In  theory,  the  program  assures  that 
operators  recognize  that  laws  will  be  enforced.  However,  court 
challenges  have  limited  the  effectiveness  of  the  program.  While 
a  penalty  program  is  needed,  penalties  are  a  negative  means  of 
assuring  operator  compliance.  Positive  incentives,  were  they  in 
place,  could  be  as  or  more  effective. 

8.0  Accidents 

8.1  Accident  Report 

8. J.l  Objective :  To  provide  the  necessary  information  for 
corrective  and  preventive  actions  to  reduce  or  eliminate  the 
likelihood  of  reoccurrence.  The  term  "accident"  includes  oil 
spills  as  well  as  fires,  personal  injuries  and  death,  structural 
failures,  and  other  malfunctions. 

8.1.2  Description:  The  lessee  is  required  to  file  an  accident 
report  within  10  days  of  the  date  of  occurrence.  All  lost-time 
accidents  (72  hours  or  greater)  are  to  be  reported.  The  lessee 
must  immediately  notify  the  district  supervisor  of  all  serious 
accidents,  any  death  or  serious  injury,  and  all  fires. 

Discharges  in  violation  of  regulations  are  to  be  reported 
immediately. 

8.1.3  Reference:  OCS  Order  No.  7,  Sec.  2.3,  30  CFR  250.45,  33 
CFR  153.203. 

8.1.4  Use  Made  of  Item:  Accident  reports  provide  the  basis 
for  taking  corrective  or  preventive  actions,  which  may  include 
issuance  of  a  notice  to  lessee,  shut-in,  investigation,  or 
revision  to  regulations. 

8.1.5  Assessment :  See  8.4.5. 

8.2  Reports  of  Spills  of  Oil  and  Liquid  Pollutants 

8.2.1  Objective :  To  provide  information  for  determining 
severity  of  spill  and  the  need  for  investigation  or  change  in 
practices . 

8.2.2.  Description:  Incident  data  reported  orally  to  the 
district  supervisor  and  confirmed  in  writing.  All  reports  must 
include  the  cause,  location,  volume  of  spill,  and  action  taken. 

8.2.3  Reference :  OCS  Order  No.  7,  Sec.  2.3. 

8.2.4  Use  Made  of  Item:  Information  gathered  m-.y  be  used  in 
an  investigation,  or  for  recommending  safe  practices  and 
preparing  safety  alerts. 
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8.2.5  Assessment :  The  collection  of  data  about  unplanned  and 
unexpected  events  is  a  valid  element  of  a  safety  management 
system.  This  program  is  redundant  since  the  Coast  Guard  has 
concurrent  responsibilities  and  has  issued  similar  reporting 
requirements.  Some  coordination  of  effort  is  indicated  among 
the  responsible  agencies  (i.e.,  MMS,  Coast  Guard,  EPA)  to 
eliminate  redundant  effort  and  reporting  requirements,  while 
still  insuring  that  each  agency  receives  needed  data  in  a  timely 
way. 

8.3  OCS  Events  File 

8.3.1  Objective:  To  collect  information  about  traumatic 
events  that  occur  on  oil  and  gas  platforms  in  the  Gulf  of  Mexico. 

8.3.2  Desc ript ion :  The  definition  of  a  traumatic  event 
includes  an  oil  spill,  a  blowout,  a  fatality,  an  injury,  a  fire, 
or  an  explosion.  File  information  contains  the  location, 
operator,  type  of  rig,  cause  of  event,  and  description  of  event. 

8.3.3  Sources  of  Data:  Accident  reports. 

8.3.4  Assessment :  Regardless  of  what  agencies  are  collecting 
data,  a  central  file  of  OCS  loss  data  is  an  essential  element  of 
an  OCS  safety  management  system.  Currently,  the  Events  File 
contains  only  Gulf  of  Mexico  information;  its  coverage  needs  to 
be  expanded  to  all  OCS  areas.  The  file  lacks  causal  data,  but 
some  effort  is  being  made  to  correct  this  inadequacy. 

8.4  Accident  Investigations 

8.4.1  Objective :  To  gather  all  the  necessary  information  to 
determine  the  causes  of  accidents,  and  to  identify  specific 
violations  of  regulations  that  may  have  occurred. 

8.4.2  Description:  Investigation  and  public  report  by  MMS  are 
required  for  fires,  oil  pollution,  deaths,  and  injuries 
associated  with  oil  or  gas  drilling  or  production  operations  and 
equipment,  including  hydrogen  sulfide  exposure.  In  addition, 
the  agency  investigates  other  incidents  related  to  its 
regulatory  purview  which  include  loss  of  well  control,  sinking, 
capsizing,  or  major  damage  to  a  vessel  or  facility.  The  degree 
to  which  an  accident  is  investigated  is  dictated  by  its  severity. 

MMS  characterizes  accidents  as  follows: 

o  Category  1:  Equipment  damage  under  $50,000  or  structural 
damage  under  $100,000,  or  pollution  of  6.3  barrels  or  less. 

o  Category  2:  Equipment  damage  of  $50,000-$100,000  or 

structural  4-mage  of  $100,00-$1  million,  or  pollution  of 
6.3  barrels,  or  a  minor  blowout. 


o  Catetory  3:  Damage  over  $1  million,  or  death,  or  oil  spill 
of  200  barrels  or  more,  or  major  blowout. 

While  accident  reports  are  filed  on  all  categories  of  accidents, 
full  investigations  and  public  reports  are  prepared  on  category 
3  accidents  and  some  others,  mainly  vessel  sinkings  and  blowout. 

The  MMS/USCG  memorandum  of  understanding  (MOU)  assigns  MMS  the 
accident  invest igation  lead  for  operational  accidents  such  as 
fires,  blowouts,  and  explosions.  USCG  has  the  lead  for 
investigation  of  other  kinds  (i.e.,  maritime/workplace  safety) 
of  accidents.  An  annual  report  tallying  OCS  accident  statistics 
is  prepared. 

When  a  category  2  or  3  accident  occurs,  an  investigator  is 
dispatched  to  the  site  as  soon  as  possible.  Also,  MMS 
Headquarters  is  notified  by  phone.  Catetory  1  accidents  may  not 
be  investigated  on  site. 

Category  3  investigations  are  conducted  at  the  regional  level. 
The  MMS  has  found  that  legal  procedures  such  as  cross 
examination  frustrate  fact  findings.  They  strive,  therefore,  to 
avoid  excessive  legal  entanglement,  though  lawyers  participate 
in  accident  investigations. 

The  MMS  conducted  62  investigations  in  1980,  47  in  1981,  and  39 
in  1982.  Of  these,  only  eight  have  been  Category  3 
investigations . 

Accident  investigations  may  lead  to  suggestions  for  changes  in 
regulations,  or  identify  particular  safety  concerns.  These,  in 
turn,  may  be  publicized  through  the  MMS  Safety  Alert  System, 
which  provides  a  safety  bulletin  to  every  OCS  workplace  (and 
others  who  request  them). 

8.4.5  As ses sment :  Accident  reports  and  investigations  are  a 

significant  element  of  a  safety  management  system  and  satisfy 
the  mission  of  monitoring  ongoing  events.  The  MMS  has  an 
accident  reporting  and  investigation  system  in  place.  One 
weakness  in  the  system  may  be  difficulty  in  translating  output 
into  regulatory  or  other  useful  action.  Although  reports  of 
near  misses  are  difficult  to  obtain,  and  comprehensive 
investigation  of  all  near  misses  is  impracticable ,  MMS  should 
consider  the  selective  investigation  of  significant  events  or 
near  misses  to  add  to  the  general  body  of  safety  knowledge. 

Part  of  the  present  program  overlaps  Coast  Guard  reporting 
requirements  as  regards  bodily  injury  and  oil  spill  reporting. 
This  overlapping  area  is  being  partly  eliminated  by  regulatory 
action. 


87 


Accidents  and  the  results  of  investigations  ought  to  be  widely 
publicized  through  safety  alerts  and  possibly  OCS  summary 
reports  —  this  does  not  appear  to  be  a  substantive  element  of 
accident  investigations. 
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SAFETV  INFORMATION  AND  MANAGEMENT  ON  THE  OUTER 
CONTINENTAL  SHELF (U)  NATIONAL  RESEARCH  COUNCIL 
HASHINOTON  DC  MARINE  BOARD  19B4  NDM14-82-G-M32 


MICROCOPY  RESOLUTION  TEST  CHART 

NATIONAL  BUREAU  OF  STANDARDS- J963-A 


APPENDIX  C* 


SUMMARY  OF  OUTER  CONTINENTAL  SHELF  SAFETY  INFORMATION  DATA  BASES 


I.  Occupational  Safety  and  Health  Administration  (OSHA)  Annual 
Survey  (OSHA  Requirements  -  29  Part  1904  -  Recording  and  Reporting 
Occupational  Injuries  and  Illnesses) 

A.  Applicability 

1.  Each  employer  except  "small  employers"  who  have  no  more 
than  10  employees  or  establishments  which  conduct  business 
primarily  in  one  of  the  Standard  Industrial  Classifications 
(SICs)  listed  by  OSHA.  To  be  exempt  from  general  record¬ 
keeping,  the  SIC  must  not  be  targeted  for  routine  inspections 
and  have  a  record  of  lost-workdays  on  account  of  injuries  at 
or  below  75  percent  of  the  private  sector  for  1978-1980  as 
published  by  the  Bureau  of  Labor  Statistics  (BLS).  This 
latter  exemption  was  implemented  on  December  28,  1982.  Oil 
and  gas  is  not  on  the  exemption  list. 

2.  Small  employers  and  exempted  SICs  must  continue  to 
report  fatalities  and  multiple  hospitalization  accidents  to 
OSHA  and  participate  in  BLS'  annual  statistical  program,  if 
selected,  by  keeping  OSHA  Form  No.  200  S  for  a  year  and 
reporting  data  at  the  end  of  the  year  on  a  special  form  under 
200  S.  (Note:  145,000  employers  who  would  ordinarily  be 
exempted  from  recordkeeping  have  been  chosen  for  the  1983 
survey. ) 

B.  Recordkeeping  requirements  for  nonexempted  employers 

1.  Maintain  at  each  establishment  a  log  and  summary  (OSHA 
No.  200  or  equivalent)  of  all  recordable  occupational 
injuries  and  illnesses  for  the  establishment  (enter  data  no 
more  than  6  days  after  occurrence). 


♦This  background  paper  was  compiled  by  the  committee  based  on  the 
findings  of  its  study. 
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2.  Complete  OSHA  Form  No.  101  or  equivalent  (within  6  days 
after  occurrence)  supplemental  record  of  each  recordable 
occupational  injury  or  illness. 

3.  Post  annual  summary  of  occupational  injuries  or  illnesses 
at  each  establishment  from  February  1  to  March  1  each  year. 

4.  Retain  records  for  5  years  following  end  of  year  to 
which  they  relate. 

5.  Make  all  records  available  to  OSHA  inspectors  and 
representatives  of  the  U.S.  Department  of  Health  and  Human 
Services  (HHS).  Make  OSHA  Form  No.  200  S  available  to 
current  and  former  employees  and  to  their  representatives. 

6.  Participate  in  BLS  statistical  program  if  selected  by 
completing  Occupational  Injuries  and  Illnesses  Survey  Form. 

C.  Definitions 

1.  Recordable  occupational  injuries  or  illnesses 

a.  Fatalities,  or 

b.  Cases  involving  lost  workdays  (days  lost  after  day 
of  injury  or  illness). 

c.  Cases  without  lost  workdays  which 

(1)  result  in  transfer  of  another  job  or 
termination, 

(2)  require  medical  treatment  (other  than  first 
aid),  or 

(3)  involve  loss  of  consciousness  or  restriction 
of  work  or  motion. 

2.  Establishment 

a.  Single  physical  location  where  operations  are 
conducted,  or 

b.  Places  where  people  are  paid  or  base  from  which 
personnel  operate  to  carry  out  the  activities  for 
those  who  do  not  primarily  report  or  work  at  a 
single  establishment. 

D.  BLS  statistical  program 

1.  Systematic  sampling  survey  done  annually.  About  280,000 
firms  take  part  in  survey  to  calculate  job  injury  and 
illness  rates. 


2.  Data  are  published  in  "Accident  Facts"  by  National 
Safety  Council. 

3.  Statistical  data  published 

a.  Incident  rates  per  100  full-time  employees  for 

(1)  total  recordable  cases, 

(2)  total  lost  workday  cases, 

(3)  cases  involving  days  away  from  work  and  deaths, 

(4)  nonfatal  cases  without  lost  workdays, 

(5)  total  lost  workdays,  and 

(6)  days  away  from  work. 

b.  Formula  for  calculation  of  incident  rates: 

Incident  Rate  * 

No.  of  injuries  &  illnesses  x  200,000  or  No.  of  lost  workdays  x  200,000 
Total  hours  worked  by  all  employees  during  covered  period 

NOTE:  200,000  *  base  for  100  full-time  equivalent  workers  (working 
40  hours  per  week,  50  weeks  per  year). 


E.  Comments 

1.  Some  0CS  employers  have  participated  in  BLS  statistical 
program  and  reported  data  for  their  establishments. 

2.  Accident  information  is  not  required  to  be  submitted 
except  as  part  of  atatistical  sampling  program. 

3.  Data  on  man-hours  worked  are  required  only  if 
establishment  is  included  in  BLS  statistical  program. 


II.  CASMAIN  Data  Base  (U.S.  Coast  Guard  Casualty  Reporting 
Requirements  -  33  CFR  Part  146;  46  CFR  Parts  4,  26,  35,  78,  97,  109, 
167,  185,  196  and  197) 

A.  Applicability:  Vessels,  mobile  offshore  drilling  units, 
barges,  fixed  offshore  platforms,  diving 

B.  Sources  of  data 

1.  Complete  Form  CG-2692,  "Report  of  Marine  Accident, 
Injury,  or  Death,"  for  certain  accidents. 
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2.  Owner,  operator,  or  pefson  in  charge  is  responsible  for 
submitting  written  report  within  10  days  of  the  casualty. 

C.  Accidents  covered  under  program 

1.  OCS  facilities 

a.  Death, 

b.  Injury  to  five  or  more  persons  in  a  single  accident, 

c.  Injury  causing  any  person  to  be  incapacitated  for 
more  than  72  hours, 

d.  Damage  affecting  the  usefulness  of  primary 
lifesaving  or  firefighting  equipment, 

e.  Damage  to  the  facility  in  excess  of  $25,000 
resulting  from  collision  by  a  vessel,  and 

f.  Damage  to  a  floating  OCS  facility  in  excess  of 
$25,000. 

2.  Other  categories  -  see  instructions  for  completion  of 
Form  CG-2692.  All  must  report  loss  of  life  and  injury 
causing  incapacitation  over  72  hours. 

D.  Comments 

1.  Coast  Guard  regulations  for  accident  reporting  apply  to 
most  activities  conducted  on  the  OCS. 

2.  To  be  reportable,  an  accident  must  result  in 
incapacitation  for  72  hours  (3  days).  Accidents  are 
recordable  under  0SHA  program  for  1  lost  work  day  or  more. 


III.  Events  File  (MMS) 

A.  Applicability:  All  OCS  lessees/operators 

B.  Sources  of  data:  Data  drawn  from  OCS  accident  reports 

C.  Accidents  covered:  all  traumatic  events,  including  oil 
spills,  blowouts,  fatalities,  injuries  (absence  from  work  for  72 
hours  or  more),  fires,  explosions,  collisions,  structural 
failures 


-  •  I 


-  •  _  « 


-  •  4 


t 


93 


D.  Comments 

1.  Event*  File  contain*  primarily  Gulf  of  Mexico 
information  —  geographic  coverage  i*  not  complete. 

2.  Reporting  requirement*  duplicate  eome  of  those  of  the 
USCG. 


IV.  Pollution  Incident  Reporting  Syatem  (U.S  Coast  Guard) 

A.  Applicability:  Collection  and  maintenance  of  diacharge 
data,  response  data,  cleanup  data,  penalty  data 

B.  Sources  of  data:  Spill  reports,  USCG  Form  No.  4890 

C.  Accidents  covered:  All  reportable  spills 

D.  Comments: 

1.  Complete  spill  data  base;  however,  spills  from  OCS 
facilities  cannot  be  screened  from  all  other  spills  without 
manual  checking. 

2.  Data  base  is  not  OCS-specif ic .  Can  be  queried  on  basis 
of  geographic  area  (e.g.,  Gulf  of  Mexico)  or 
latitude/longitude. 

V.  "Charlie  Reports"  (International  Association  of  Drilling 
Contractors — 1ADC) 

A.  Applicability:  Annual  summary  report  of  drilling  injuries 
and  deaths,  designed  for  comparative  studies  by  drilling 
contractors 

B.  Sources  of  data:  Voluntary  reports  of  member  companies; 
includes  reports  on  about  93  percent  of  drilling  rigs  and  95 
percent  of  the  offshore  work  force 

C.  Accidents  covered:  Fatalities  and  injuries  resulting  in 
inability  of  injured  worker  to  return  to  work  within  12  hours 
(one  shift) 

D.  Consents: 

1.  Adjustments  must  be  made  to  compare  XADC  statistics  to 
other  statistic*: 
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a.  USCG  and  MMS  data  bases  define  lost-time  injuries 
as  72  hours  off  the  job.  The  IADC  and  the  BLS 
define  lost-time  injury  as  failure  to  report  for 
the  next  shift  (12  hours  in  the  case  of  the  OCS). 

b.  The  IADC  data  system  is  designed  for  use  in 
analysis  of  the  OCS  drilling  workplace,  and  is  not 
consistent  with  widely  used  American  National 
Standards  Institute  (ANSI)  guidelines  for  safety 
data  recordkeeping.  Notably,  safety  data  on 
maritime  operations  is  usually  based  on  a  24-hour 
day.  IADC  workers  are  reported  at  risk  for  12 
hours  a  day  (man-hours  worked  are  reported).  The 
effect  of  this  is  that  IADC  accident  rates  appear 
twice  as  high  as  other  maritime  accident  rates, 
because  the  exposure  base  is  defined  as  half  that 
of  other  maritime  accident  data  bases. 

2.  IADC  data  distinguish  between  offshore  and  onshore,  but 
do  not  distinguish  OCS  from  other  offshore  areas. 


VI.  MMS  Platform  Inspection  Information  System 

A.  Applicability:  Provides  field  inspectors  with  an  analysis 
of  a  structure  and  past  inspection  history 

B.  Source  of  data:  Field  inspectors'  reports 

C.  Coverage:  The  Platform  Inspection  Information  System 
contains  information  gathered  during  inspections  of  oil  and  gas 
platforms.  There  is  information  about  the  platform,  hours  spent 
inspecting,  violations,  departures  granted,  safety  device 
settings  and  pipelines,  well  bay  operations,  production  vessels, 
header  systems,  fired  vessels,  and  possible  items  of  noncompli¬ 
ance.  A  subset  of  the  system,  the  complex/structure  list, 
contains  platform  data  including  identifying  information, 
distance  from  shore,  water  depth,  structure  detail  such  as 
number  of  drilling  slots,  year  installed,  and  year  removed. 

D.  Comments: 

1.  Provides  current  information  on  deficiencies,  which  can 
be  used  to  identify  not  only  the  activities  that  pose  the 
most  consistent  problems,  but  also  the  companies  and 
locations. 

2.  These  data  provide  MMS  management  with  a  way  to  monitor 
the  activity  of  its  field  inspection  offices. 

3.  Exposure  data  in  the  form  of  platform  years  can  be 
obtained  from  the  complex/structure  list. 
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4.  Includes  Gulf  of  Mexico  complexes /structures  only. 
However,  similer  decs  ere  eveilsble  in  Che  other  regions. 


VII.  MMS  Borehole  end  Completion  File 

A.  Applicebility:  Provides  a  complete  engineering  data  file  on 
each  borehole 

B.  Sources  of  data:  Forms  DI9-330,  "Well  Completion  Report," 
and  DI  9-331,  "Sundry  Notice" 

C.  Coverage:  Contains  borehole  and  completion  information 
about  each  veil.  Some  of  the  data  elements  are  field  name, 
lease  number,  well  name,  and  operator.  For  each  borehole,  there 
are  total  depth,  date  total  depth  reached,  and  elevation.  For 
each  completion,  there  are  date  of  completion,  perforation 
interval,  type  of  completion,  top  production  horizon,  and 
reservoir  name. 

D.  Comments: 

1.  Includes  Gulf  of  Mexico  wells  only.  However,  similar  data 
are  available  in  the  other  OCS  regions. 

2.  Can  provide  exposure  data,  specifically  wells  completed  per 
year. 

3.  A  separate  file,  the  well  history  production  file,  contains 
individual  well  production  data. 


VIII.  Lease  Production  and  Revenue  File 

A.  Applicability:  Provides  statistical  documentation  of 
revenue  derived  from  individual  leases  both  from  lease  sales  and 
annual  rentals  and  production 

B.  Sources  of  data:  Lease  sale  and  production  records 

C.  Coverage:  The  base  contains  quantitative  information 
regarding  offerings  by  bidders  for  federal  mineral  leases  and 
all  production  and  revenue  by  year  by  individual  lease 

D.  Comments: 

1.  These  data  are  used  by  the  U.S.  Department  of  Energy,  the 
U.S.  Department  of  the  Interior,  the  Federal  Trade  Cosm>ission, 
and  nongovernment  organizations  and  companies  for  various 
analyses. 


The  det*  ere  available  to  the  public. 
Source  of  production  exposure  data. 
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AN  OUTER  CONTINENTAL  SHELF  OPERATING  COMPANY *S  MANAGEMENT  OF  SAFETY 

By  John  Volfe 
Conoco,  Inc. 

ORGANIZATION 


The  single  most  important  element  of  safety  at  Conoco  is  that  safety 
is  a  direct  line  responsibility  of  Conoco  managers.  The  senior  safety 
official  is  the  vice  president  for  North  American  Production  Opera¬ 
tions,  who  oversees  all  the  activities  of  the  operating  divisions. 

The  two  subsidiary  organizations  under  him  with  the  largest  roles  in 
OCS  safety  are  the  Production  Division,  which  controls  offshore 
drilling  and  production  operations,  and  the  Human  Resources  Group, 
which  has  staff  responsibility  for  the  corporate  safety  program. 

Below  the  vice  president,  tv  line  responsibility  for  safety 
resides  with  operating  divis^'  The  production  manager,  his 
production  superintendents,  t  che  operating  personnel  are  primarily 
responsible.  Subsidiary  groups  coordinate  safety  training,  gather 
safety  statistics,  and  help  where  possible ,  but  the  fundamental 
responsibility  for  the  safety  of  operations  is  in  the  line  production 
organization. 

At  our  headquarters  in  Houston,  an  administration  section 
controls  personnel  development.  A  corporate  training  group  within 
this  section  houses  a  safety  specialist.  This  safety  specialist  is  a 
consultant  to  the  division  safety  specialists,  who  in  turn  are  con¬ 
sultants  to  the  production  superintendents  and  the  line  organization 
in  the  field. 

The  offshore  operations  manager  in  Houston  has  under  his 
supervision  the  division  managers  in  New  Orleans,  Lake  Charles,  and 
Lafayette,  Louisiana.  These  divisions  are  slightly  different  in  their 
makeup  but  have  very  similar  operational  organizations.  The  safety 
specialist  in  a  small  division  such  as  Lafayette  may  have  some 
training  duties  outside  the  safety  area  as  well. 

The  Corporate  Safety  Division  may  make  safety  inspections  of 
offshore  facilities  from  time  to  time  or  may,  upon  request,  supply 
information  or  make  presentations  at  monthly  safety  meetings.  In  some 
cases  corporate  personnel  supply  safety  information  and  training 
materials  to  the  operating  divisions. 


TRAINING 


Training  is  a  very  important  element  of  the  division's  safety 
program.  It  is  difficult  to  separate  safety  aspects  from  operational 
aspects.  If  you  are  adequately  trained  to  operate  the  equipment  on 
the  platforms  through  apprenticeships  and  special  schools  to  the  point 
of  really  understanding  your  equipment  and  job,  the  safety  of  the 
equipment  and  of  the  personnel  involved  goes  hand  in  hand.  Net.  equip¬ 
ment  added  to  an  offshore  platform  must  go  through  a  commissioning 
function,  in  which  training  sessions  are  held  for  involved  personnel. 
Manufacturers'  representatives,  and  possibly  equipment  specialists 
from  the  corporate  production  engineering  services  group,  and  other 
outside  personnel  may  participate  in  this  commissioning  and  testing. 

The  safety  of  employees  begins  on  the  first  work  day  before  they 
go  offshore,  as  these  employees  are  required  to  view  safety  slide 
presentations  on  offshore  safety  and  helicopter  safety  before 
embarking  offshore.  The  new  worker  is  also  provided  with  various 
safety  manuals. 

In  his  first  year  of  employment,  usually  the  earlier  the  better, 
each  offshore  employee  will  attend  an  aquatic  survival  course,  which 
is  an  8-hour  in-the-water  course  taught  by  survival  experts.  This 
equips  the  employee  for  survival  in  Gulf  waters  should  this  be 
necessary.  The  new  employee  is  also  required  to  take  first-aid 
training,  including  cardiopulmonary  resuscitation.  This  first-aid 
course  is  repeated  on  an  annual  basis  for  all  personnel  who  might  be 
directly  involved  in  this  activity.  Most  corporate  courses  of  this 
nature  are  repeated  on  3-year  cycles. 

Conoco  also  operates  its  own  fire-fighting  training  courses, 
which  provide  hands-on  emergency  response  training.  Each  person  on  an 
offshore  platform  attends  these  courses  as  designated  by  the  various 
divisions  on  the  3-year  repeat  cycle. 

All  company  personnel  who  are  assigned  company  automobiles  or  who 
are  expected  to  drive  such  automobiles  are  required  to  attend  a  defen¬ 
sive  driving  course  on  a  3-year  basis.  Attendance  at  these  defensive 
driving  courses  are  open  to  all  employees  and  their  families. 

Any  offshore  worker  in  a  position  to  operate  an  offshore  crane 
must  be  certified.  An  8-hour  class  is  required  for  certification. 
Subsequently,  crane  operators'  performance  is  observed  in  the  field. 

The  Minerals  Management  Service  (MMS)  requires  some  offshore 
workers  to  receive  well  control  training.  This  training  is  normally 
obtained  by  Conoco  workers  at  company  schools.  Some  use  is  made  of 
available  outside  schools. 
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There  are  a  number  of  PETEX  courses,  (the  Petroleum  Extension 
Service  of  the  University  of  Texas),  and  several  American  Petroleum 
Institute  (API)  safety  programs  available  for  special  training. 
Selected  individuals  with  safety  responsibilities  are  sent  to  these 
schools  on  a  continuing  basis. 

Encounters  with  hydrogen  sulfide  are  a  major  offshore  hazard, 
though  not  in  the  Gulf  of  Mexico.  Conoco  has  an  extensive  hydrogen 
sulfide  manual  and  has  qualified  personnel  to  give  instructions  on 
this  equipment  should  it  be  required. 


PROCESS  DESIGN 


Who  is  responsible  for  the  process  system  and  its  design  prior  to 
installation  on  the  platform?  First  of  all,  safety  is  one  of  the 
factors  considered  in  the  selection  of  process  systems.  The  design 
engineers,  whether  they  be  in  the  local  division  office,  the  Houston 
engineering  services  group,  or  from  an  outside  organization,  all  are 
aware  of  the  desire  for  safety  in  Conoco1 s  operation.  Where  possible, 
we  avoid  fired  vessels;  this  means  that  waste  heat  from  compressors  or 
engine  exhaust  is  used  to  supply  any  required  heat.  The  offshore 
safety  manual  details  a  number  of  requirements  to  avoid  having  exposed 
fires  on  offshore  platforms.  Where  these  fires  are  required, 
extensive  safety  measures  are  taken  to  avoid  any  problems. 

All  of  the  facilities  on  Conoco' s  platforms  are  initially  designed 
to  API  specification  14C,  or  more  rigid  criteria.  API  specification 
14C  was  developed  early  in  the  1970s  to  provide  guidance  for  all  opera¬ 
tors  in  process  system  design.  It  has. since  been  incorporated  in  OCS 
orders.  Under  API  auspices,  a  committee  was  formed  to  supervise  the 
14  series  documents  relating  to  offshore  safety  and  pollution.  These 
include  surface  safety  valves,  subsurface  safety  valves,  underwater 
safety  valves,  electrical  systems,  piping  systems,  and  fire  safety. 

Minor  projects  and  changes  in  existing  field  processes  are 
normally  made  at  the  operating  division  level.  The  operating  division 
may  request  help  from  the  Production  Engineering  Services  staff  but 
are  not  by  any  means  required  to  do  so.  They  may  also  use  consulting 
engineers  or  equipment  personnel  from  suppliers  to  assist  in  the 
design.  They  normally  make  the  safety  analysis  for  these  changes  in 
the  division  office. 

Major  projects  may  require  assistance  from  the  Production 
Engineering  Services  staff  and  are  sometimes  farmed  out  to  consulting 
firms  for  total  engineering  design.  If  this  is  done,  some  of  Conoco' s 
engineering  personnel  may  be  detailed  to  the  contractor's  office. 
Overall  safety  of  the  total  package  is  included  in  this  phase. 
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All  monitoring  and  paper  work  to  meet  the  MMS  regulatory 
requirements  are  handled  by  operating  division  offices. 

SAFETY  MEETINGS 

The  basic  management  tool  used  to  keep  operating  personnel  sound  in 
their  attitudes  toward  safety  is  a  monthly  safety  meeting.  Topics  for 
safety  meetings  are  selected  by  local  personnel  to  suit  their  opera¬ 
tion.  There  are  even  some  for  home  safety,  such  as  defensive  driving, 
safety  in  water  sports,  or  hunting  safety.  It  is  very  difficult  to 
draw  the  dividing  line  between  an  operational  relationship  for  the 
equipment  and  the  safety  relationship  for  the  equipment.  The  most  one 
can  strive  for  is  to  integrate  safe  practices  into  the  daily  routine 
of  operating  personnel. 

In  addition  to  monthly  safety  meetings,  most  work  sites  have 
5-minute  safety  discussions  at  the  start  of  each  work  day.  In  these 
meetings,  the  proposed  activities  for  the  day  are  discussed  and  unusual 
safety  aspects  may  be  reviewed. 

Where  practical,  quarterly  meetings  are  held  on  a  larger  area 
basis  so  that  experiences  are  more  fully  shared. 

When  unusual  operations  are  to  take  place,  such  as  welding 
operations  requiring  hot  work  permits  or  any  other  potentially 
hazardous  operation,  a  safety  meeting  of  5  or  10  minutes  is  usually 
convened  before  beginning  work.  All  safety  aspects  are  discussed  at 
that  time. 

In  the  regular  monthly  safety  meetings,  the  staff  or  outside 
speaker  may  be  the  main  event,  but  he  does  not  govern  the  total 
activity  of  the  meeting.  Operating  personnel  may  review  any  accidents 
that  have  occurred.  Near-accidents  also  may  be  covered.  Questions 
also  may  be  raised  about  equipment  or  potentially  hazardous  situations. 
If  these  ideas  are  forthcoming  and  the  hazards  reported  have  not  been 
corrected  prior  to  the  safety  meeting,  some  individual  will  be  dele¬ 
gated  to  handle  the  problem  or  some  schedule  adopted  to  review  the 
safety  question  involved. 


INSPECTIONS 

Safety  inspections  are  made  of  all  platforms  on  a  6-month  schedule. 
Teams  are  selected  by  the  division  manager,  usually  including  repre¬ 
sentatives  of  the  construction  group,  the  safety  and  environmental 
section,  the  systems  group,  and  an  operation  representative.  Others 
may  be  incorporated  for  specific  platforms  as  required. 
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At  the  completion  of  the  inspection,  report  forms  are  filled  out 
and  submitted  to  the  division  manager.  Any  deficiencies  noted  on 
these  forms  must  be  corrected  and  a  report  filed  to  the  manager  when 
such  correction  has  been  completed. 

Separate  inspection  teams  measure  vessel  and  pipe  thicknesses  on 
recurring  schedules  determined  by  platform  sand  production  and  other 
factors. 

Routine  safety  inspections  and  tests  are  conducted  as  required  by 
MMS.  However,  additional  tests  are  made  to  insure  that  equipment  is 
properly  functioning  at  all  times.  At  the  beginning  of  each  month  a 
computer  printout  is  developed  of  the  tests  required  by  well  in  a 
given  area,  during  the  following  month.  This  is  used  by  the  operating 
personnel  in  the  field  to  schedule  their  safety  inspections  on  the 
various  wells  and  equipment  required  for  continued  safety  operation. 

If  MMS  issues  a  safety  alert  that  indicates  a  change  in 
operations,  the  field  usually  discusses  this  at  the  next  safety 
meeting,  or  may  call  a  special  meeting  to  discuss  the  safety  alert 
when  it  is  issued  if  it  is  a  very  urgent  situation. 


INDUSTRY  ACTIVITIES 

Conoco  keeps  its  safety  programs  current  through  active  participation 
in  industry  activities,  including  the  activities  of  the  API  safety 
committee  (and  other  committees  such  as  that  previously  mentioned) 
which  oversees  the  14  series  of  engineering  standards.  Company 
personnel  also  participate  in  regional  safety  meetings  with  other 
industry  personnel. 


CONTRACTOR  RELATIONSHIPS 

How  does  Conoco  assure  that  its  contractors  operate  safely?  Probably 
the  most  closely  associated  are  drilling  contractors.  Conoco  and  many 
other  offshore  operators  do  not  own  drilling  equipment,  but  contract 
instead  for  drilling  services  from  various  suppliers.  Safety  is  one 
of  the  considerations  in  bid  selection.  In  periods  of  slack  activity, 
such  as  at  present,  Conoco  can  be  a  little  more  selective  in  its 
contractors.  In  addition  to  selecting  contractors  on  the  basis  of 
safety  as  well  as  price,  Conoco  stresses  to  its  contractors  that  safe 
operations  lower  insurance  rates  and,  to  a  certain  extent,  direct 
costs. 

Conoco  controls  very  closely  certain  safety  aspects  of  its 
offshore  drilling  contractors.  These  are  usually  specified  in  the 
detailed  well  plan.  They  include  mud  weights,  pipe  setting  depths, 
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blow  out  preventor  equipment  requirements  (including  tests), 
directional  programs,  provision  for  joint  production  and  drilling 
activities,  and  many  others.  Conoco  tries  to  use  the  safety  expertise 
of  its  drilling  contractors  to  supplement  that  of  its  own  drilling 
personnel  in  all  situations. 

The  second  largest  contract  group  in  the  field  are  labor 
contractors.  In  any  given  area,  Conoco  will  generally  settle  on  a  few 
chosen  contractors  whose  performance  can  be  monitored  closely.  They 
are  encouraged  to  have  their  own  safety  program.  Some  are  not  large 
enough  to  have  their  own  strong  safety  program,  so  these  contractors 
may  be  invited  to  attend  Conoco  safety  meetings  where  standards  of 
achievement  are  outlined.  They  may  also  be  provided  access  to 
corporate  manuals  and  training  aids.  Conoco  maintains  records  on 
all  labor  contractors  and  closely  monitors  their  accident  records. 

Other  major  contractors  on  drilling  rigs  include  mud  suppliers, 
cementing  operations,  logging  and  perforating  companies,  and  downhole 
safety  equipment  specialists.  In  all  these  areas,  Conoco  buys  service 
through  contracts;  included  in  that  service  is  a  required  safety 
aspect. 


REGULATIONS 

In  the  implementation  of  new  regulations,  Conoco  makes  an  analysis  at 
headquarters  of  the  effect  on  operations.  Headquarters  then  makes 
recommendations  to  the  operating  divisions  after  discussing  with  them 
how  the  regulations  might  influence  their  operation.  The  following 
questions  are  asked:  Are  they  going  to  require  additional  people?  Is 
equipment  adequate  or  is  new  equipment  needed  to  comply  with  these 
regulations;  or.  Is  additional  money  going  to  be  required  to  update 
existing  equipment? 

After  these  questions  have  been  adequately  answered,  the  division 
managers,  through  the  field  operating  organization,  implement  the  new 
regulations.  If  it  requires  monitoring,  it  will  be  done  by  the  safety 
specialist  in  the  division  with  the  advice  and  consultation  of  safety 
or  maybe  process  personnel  in  the  headquarters  organization. 

Follow-up  checks  will  be  made  by  managers  and  their  safety  and 
regulatory  specialists  on  a  routine  basis. 


QUALITY  ASSURANCE 

What  does  a  major  company  do  about  quality  assurance  on  the  multitude 
of  products  used  offshore?  The  major  products  -  the  valves  which 
control  process  flow  and  on  which  safety  depends  are  tested  in 
Conoco’s  research  laboratory.  Valves  that  fail  will  not  be  purchased. 
For  some  of  che  specialty  items  such  as  the  subsurface  safety  valves 


which  were  mentioned  before,  Conoco  reliea  on  the  Aaericen  Petroleum 
Institute/Aaerican  Society  of  Mechanical  Engineera  (API/ASME)  program 
for  teating.  The  company  doea  only  a  limited  amount  of  in-house 
teating  due  to  the  highly  apecialized  nature  of  the  product. 

Field  reaulta  of  problema  or  aucceaaea  are  communicated  to  the 
worldwide  Conoco  organization  through  the  operationa  group  in  Houaton 
and  through  the  Production  Engineering  Servicea  group.  The  Production 
Engineering  Servicea  group  receives  monthly  operation  reporta  from 
each  diviaion  and  each  international  aubaidiary.  These  are  reviewed 
for  successes  and  failures,  and  noteworthy  reports  are  brought  to  the 
attention  of  other  divisions  where  they  might  have  application.  The 
monthly  operation  report  also  includes  a  record  of  the  safety  and 
operational  training  that  has  taken  place,  and  safety  and  environmental 
sections  which  spread  the  word  on  successes  or  problems  with  equipment 
and  processes. 

Of  course,  in  all  quality  assurance  activities,  our  surface  and 
subsurface  safety  valves  are  designed  and  operated  in  accordance  with 
the  MMS  regulations. 

In  analyzing  the  safety  of  our  equipment,  we  find  that  over  96 
percent  of  the  failures  involved  are  not  equipment-related  but  are 
people-related. 


ACCIDENT  REPORTING 

Despite  Conoco' s  best  efforts  to  avoid  accidents,  some  do  occur.  How 
are  accidents  reported?  First  of  all,  is  the  accident  job-related? 

It  so,  was  any  lost  time  or  restricted  duty  required?  Did  the 
accident  require  medical  treatment  or  first  aid?  If  so,  Occupational 
Safety  and  Health  Administration  (OSHA)  requirements  and  the  MMS 
requirements  for  accident  reporting  must  be  complied  with.  Any 
accident  will  be  followed  up  by  an  investigation  team.  Where 
possible,  one  member  of  that  team  will  be  the  person  involved  in  the 
accident.  Reports  of  accidents  of  this  type  will  be  circulated  from 
the  field  organization  through  the  division  management  organization, 
through  the  North  American  Production  organization,  and  to  the 
operational  vice  president  in  charge  of  North  American  Production.  To 
my  knowledge,  Conoco  is  the  only  company  where  a  report  of  this  nature 
receives  that  kind  of  attention  at  the  vice  presidential  level. 

What  about  off-the-job  accidents?  If  it  is  an  accident  that 
should  be  publicized  further,  it  may  be  printed  in  newsletter  form  and 
circulated  to  all  divisions.  Off-the-job  accidents  may  be  included  in 
safety  meeting  programs,  and  will  be  reported  through  channels  as 
above,  though  usually  not  to  the  vice  president. 


In  most  of  the  offshore  divisions,  selected  sefety  magazines  are 
sent  to  the  homes  of  employees  for  the  use  of  the  family  in  off  the 
job  safety.  This  is  a  part  of  continuing  awareness  which  is  the  basis 
of  the  safety  program  in  Conoco. 

The  automotive  accident  program  relates  only  in  a  small  manner  to 
our  offshore  activity,  but  still,  driving  in  New  Orleans  or  any  other 
major  city  has  some  aspects  of  safety  involved  in  it.  Auto  accidents 
are  classed  as  either  preventable  or  nonpreventable  and  are  reported 
through  channels.  Monthly  reports  are  made  on  the  total  automotive 
fleet  on  a  company-basis,  and  managers  see  who  had  accidents  in  what 
division  last  month. 

Major  accidents  such  as  fires,  deaths,  or  large  oil  spills  are 
investigated  by  selected  teams,  usually  from  the  division  office.  The 
reports  of  these  various  teams  are  circulated  within  the  company,  and 
to  MMS  or  to  OSHA  as  required.  A  major  spill,  fire,  or  death  will  be 
immediately  reported  to  the  headquarters  office  by  telephone  and  will 
be  followed  by  the  investigative  reports  mentioned  above.  Any  changes 
in  policy,  equipment,  or  operational  programs  recommended  by  these 
reports  will  be  immediately  implemented  in  the  division  where  the 
incident  occurred  and  may  be  expanded  to  the  total  production 
operation  if  the  vice  president  so  desires.  Reports  of  major  incidents 
are  telephoned  to  headquarters  for  several  reasons,  not  the  least  of 
which  is  that  corporate  vice  presidents  do  not  like  to  find  out  about 
that  kind  of  accident  from  the  evening  news  or  in  the  local  paper. 


INCENTIVE  AWARDS 

In  addition  to  the  training  programs,  continuous  management  efforts, 
and  preaching  safety,  Conoco  has  an  incentive  award  program. 
Individuals  receive  awards  for  5  years'  accident-free  work.  Operating 
areas  hold  safety  award  dinners  for  each  year  without  an  accident. 
Normally,  spouses  are  included  at  safety  award  dinners  because  they 
can  influence  the  activities  of  their  counterparts. 

For  automotive  unit  operators,  there  are  5-year  safe  driving 
awards  for  those  assigned  vehicles. 


SUMMARY 

In  summary,  how  do  you  approach  safety  program  management  within  a 
major  company?  First  of  all,  you  start  at  the  top.  But  it  cannot 
function  without  each  employee  doing  his  part.  Conoco's  philosophy  is 
to  provide  a  safe  work  environment,  safe  tools,  and  adequate  training, 
and  to  instill  safety  attitudes  in  all  employees.  When  this  occurs, 
it  is  then  up  to  the  individual  to  maintain  that  safety  attitude  in 
all  his  activities. 


APPENDIX  E* 


OUTER  CONTINENTAL  SHELF  WORK  PRACTICES 


Outer  continental  shelf  (OCS)  oil  and  gas  operations  involve  many  of 
the  practices  common  in  the  onshore  oil  and  gas  industry  and  also  the 
maritime  industry.  Some  OCS  work  practices  place  unusual  conditions 
on  workers.  These  include: 

o  Commuting  to  and  from  work  is  time-consuming,  frequently 

involves  multiple  forms  of  transportation,  and  may  be  risky. 

o  The  workplace  isolates  the  workers  from  their  family  and/or 
usual  social  support  systems. 

o  Offshore  work  regularly  employs  workers  on  shifts  longer  than 
8  hours. 

o  Offshore  work  is  scheduled  around-the-clock.  Thus,  night 
work  is  required. 

o  Offshore  work  regularly  employs  a  work  week  of  more  than  5 
consecutive  workdays. 

o  Shift  starting  times  and  workweek  starting  days  are  not 
standard  or  identical  throughout  the  industry. 

o  Relief  for  workers  doing  heavy  physical  work  is  unstructured 
and  not  mandatory. 

Individually,  many  of  the  above  conditions  and  practices  are 
present  in  other  industries.  However,  in  combination,  these  conditions 
and  practices  yield  a  unique  combination  of  work  systems,  equipment, 
and  special  environmental  conditions. 


♦This  background  paper  was  compiled  by  the  committee  based  on  the 
findings  of  the  study. 
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The  12-hour  work  day  ia  common  on  Che  OCS  and  ia  coupled  with  7 
or  more  conaeeutive  workdays.  This  contrasts  with  the  use  of  the 
12-hour  workday  in  other  industries,  where  it  is  usually  part  of  a 
compressed  work  week  whereby  the  12-hour  workday  is  limited  to  3  or  4 
consecutive  days  (Northrup  et  al.,  1979;  Northrup,  1951).  The  OCS 
work  schedule  has  evolved,  possibly  as  an  adaptation  to  remote  loca¬ 
tions  and  management's  desire  to  use  two  crews  instead  of  three. 

Where  the  12-hour  day  for  7  or  more  consecutive  days  has  been 
tried  in  other  industrial  settings  (Sergean,  1971;  Reynolds,  1941), 
it  was  abandoned  due  to  increases  in  fatigue  and  discontent  as  well 
as  reduction  in  output.  A  recent  review  of  the  literature  predicts 
increases  in  performance  error  of  80  to  180  percent  if  around  the 
clock  operations  are  covered  by  two  12-hour  shifts  rather  than  three 
8-hour  shifts  (Kelley  and  Schneider,  1983).  This  estimate  may  be 
conservative  since  it  did  not  include  the  possible  effects  of  a  7-day 
or  longer  work  week.  Other  investigations  provide  additional  evidence 
that  fatigue  levels  and  vigilance  may  be  adversely  affected  by  the 
12-hour  day  (Swain  and  Guttman,  1980). 

Furthermore,  there  is  quantitative  data  that  a  number  of  special 
hazards  can  be  associated  with  night  work  (Johnson  et  al.,  1981),  that 
the  accident  rate  is  affected  by  the  time  of  day  at  which  shifts  start 
(Pokorny  et  al.,  1981),  that  fixed  rest  breaks  are  superior  to 
irregularly  occurring  breaks  (Bhatia  and  Murrell,  1969),  and  that 
self-ratings  by  workers  of  their  performance  need  not  correlate  with 
accident  risk  (Mackie  and  Miller,  1978). 

The  effect  of  OCS  work  practices  on  safety  has  not  been  fully 
evaluated.  A  special  study  would  be  necessary  to  discern  the  effect, 
if  any,  of  various  OCS  work  practices  on  the  safety  performance  of  OCS 
workers.  Collecting  data  would  be  difficult,  but  is  feasible.  In 
addition  to  data  on  safety  performance,  information  would  be  needed  on 
shift  duration,  shift  starting  times,  shift  rotation  rates,  crew 
manning  sizes,  work  break  practices,  days-off  durations,  and  other 
related  variables.  In  gathering  data,  care  would  have  to  be  exercised 
to  insure  that  the  effect  of  one  variable  would  not  be  masked  or 
distorted  by  another  variable. 
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APPENDIX  F* 


POTENTIAL  OF  AUTOMATION  TO  IMPROVE 
PCS  SAFETY  INFORMATION  MANAGEMENT 


Once  the  Mineral*  Management  Service  (MMS)  has  a  complete,  organised, 
and  automated  outer  continental  shelf  (OCS)  safety  information  system, 
it  will  be  possible  for  industry  to  transmit  its  own  data,  including 
computerized  safety  data,  directly  to  the  MMS.  There  are  precedents 
for  this.  At  present  the  Customs  Service  receives  information  from  a 
steamship  carrier  by  computer  communications  links  (Container  News, 
1983).  Such  transfer  benefits  both  government  and  industry.  While  it 
does  not  improve  the  system  or  make  it  work  better,  it  does  expedite 
and  ease  the  data  handling  burden.  Questions  have  been  postulated  as 
to  whether  computerized  data  links  from  offshore  locations  could  be 
established  with  regulatory  agencies  to  transmit  and  receive  safety 
information. 

The  offshore  oil  industry  has  been  as  aggressive  as  other 
industries  in  using  computers  in  its  business  and  engineering 
activities.  Since  most  of  the  management  (decision-making)  progress 
has  been  on  shore,  the  computers  have  generally  been  located  ashore. 

An  early  computer  production  control  (CPC)  system  fed  information 
from  offshore  production  controls  and  sensing  units  to  a  central  com- 
pu 1 1 • ,  which  in  turn,  fed  control  signals  back  to  the  production 
equipment.  More  recently,  computer  data  collection  (CDC)  systems  have 
been  developed,  sometimes  with  computer  terminals  located  offshore  to 
input  the  extensive  data  generated  by  a  producing  oil  field.4  Such 
systems  can  be  adapted  to  the  collection  of  safety  information,  if  the 
volume  of  information  makes  this  desirable. 

Some  companies  have  developed  computerized  maintenance  systems. 
Most  of  these  involve  shore-based  computers  which  feed  work  instruc¬ 
tions  to  offshore  workers  by  computer  printouts  and  receive  information 

♦This  background  paper  was  compiled  by  the  committee  based  on  the 
findings  of  the  study. 

♦Floyd  E.  Carrot,  Exxon  Company,  U.S.A.,  personal  communication, 
September  1983. 
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on  completed  work  via  the  tame  printouts  as  annotated  by  the  workmen. 
These  systems  have  an  indirect  effect  on  safety  to  the  extent  that 
they  improve  the  quality  and  reliability  of  equipment  maintenance. 

The  largest  offshore  operators  have  their  own  computerized  safety 
information  systems  to  store,  handle,  and  manage  safety  information. 
However,  the  use  of  computers  does  not  automatically  provide  the  reli¬ 
able  transmission  of  data.  Some  form  of  telecommunications  is  needed 
to  transmit  information  from  point  to  point,  whether  computers  are 
involved  or  not.  Hardwire  telephone  lines  are  available  offshore  on 
some  of  the  established  production  fields.  Microwave  links  are  used 
extensively  where  line-of-sight  communications  are  possible.  Various 
forms  of  radio  transmissions  have  been  used  for  voice  communications. 
However,  the  establishment  of  highly  reliable  communications  links  to 
handle  large  quantities  of  information  (such  as  is  required  for  com¬ 
puters  to  conmiunicate)  have  not  been  as  common,  due  to  the  high  costs 
and  technical  problems.  Recently,  however,  communications  between 
offshore  platforms  and  shore  locations  have  been  established  through 
satellites  operated  by  the  COMSAT  (INMARSAT)  system;  and  more  recently 
via  a  specialized  satellite  system  established  by  Geosource/SBS 
Communications,  Inc.  These  have  the  capability  of  linking  offshore 
computers  to  onshore  computers  (Ocean  Industry,  1983).  Undoubtedly, 
such  computer-to-computer  links  will  be  established  as  they  become 
cost  effective.  Some  of  the  computer  data  collection  systems  already 
have  the  capability  of  transmitting  offshore  data  to  onshore  units  via 
offshore  computer  terminals.  Such  links,  where  available,  could  be 
used  to  transmit  safety  information. 

From  the  foregoing  it  can  be  seen  that  computerized  links  between 
the  government's  safety  information  system  and  OCS  installations  and 
workplaces  would  be  technically  feasible,  provided  that  the  government 
established  a  well-organized  and  comprehensive  data  base,  and  developed 
the  necessary  analytical  capabilities  to  make  use  of  such  a  system. 
However,  it  should  be  recognized  that,  barring  unforeseen  development, 
the  volume  of  safety  information  on  individual  platforms  would  not  be 
sufficient  to  justify  computerised  telecommunications.  It  is  also 
unlikely  that  corporate  managers  would  sanction  the  direct  transmission 
of  information  between  offshore  oil  installations  and  the  government 
without  some  supervisory  control.  Furthermore,  it  is  far-fetched  that 
regulatory  agency  analysts  could  produce  safety  analyses  specific  or 
detailed  enough  to  assist  individual  offshore  platforms  in  identifying 
specific  accident  causes  in  near-real-time,  since  highly  detailed 
causal  or  forensic  information  about  accidents  is  most  often  acquired 
after-the-fact  from  eyewitness  accounts  and  as  the  result  of  special 
investigation. 

Although  the  volume  of  safety  information  collected  from 
individual  platforms  may  not  justify  computerized  telecommunications, 
another  elternative  is  the  use  of  low-cost  microcomputer  systems  which 
use  disks  for  program  input  and  data  output.  Microcomputers  are 
already  used  in  a  great  many  industrial  settings,  including  offshore 
operations.  Furthermore,  the  federal  government  has  begun  to  take 
advantage  of  microcomputers  for  data  acquisition  (Ackland,  1983). 


Ill 


The  government  could  provide  OCS  installations  end  workpiece* 
with  safety  information  program  input  disks,  es  well  as  safety 
information  data  output  disks,  to  gather  information  for  the 
government's  safety  information  system  ashore.  The  government- 
supplied  software  could  be  written  for  a  number  of  microcomputer 
operating  systems  so  that  the  safety  information  programs  would  be 
available  for  more  than  one  manufacturer's  system.  The  government 
safety  information  system  would  also  be  designed  to  handle  input  from 
safety  information  data  output  disks  produced  by  these  various 
systems.  Safety  information  data  output  disks  would  be  forwarded, 
after  data  entry,  to  the  government  by  mail  or  other  form  of 
transmission;  the  use  of  telecoimnunication*  would  be  optional. 

An  on-site  microcomputer  system  has  five  potential  advantages. 
First,  the  system  provides  sophistication  and  flexibility  at  low 
cost.  Second,  the  software  could  be  designed  to  yield  the  same  data 
as  existing  manual-entry  safety  information  data  forms.  Thus,  industry 
use  of  the  computerized  system  would  be  optional.  Third,  the  ability 
of  corporate  managers  to  preview  and  sanction  the  forwarding  of  speci¬ 
fic  safety  information  disks  would  not  be  precluded  since  direct 
telecommunications  transmission  would  be  optional  given  the  use  of  the 
disk  medium. 

Fourth,  adaptive  ("tailored")  form  completion  techniques  could  be 
incorporated  in  the  software  to  determine  which  safety  information 
forms/data  are  to  be  collected  for  the  specific  platform  and/or  safety 
incidence.  This  would  insure  that  all  appropriate  information  is 
requested,  that  inappropriate  information  is  not  requested,  and  the 
same  information  is  not  requested  more  than  once.  This  is  another  way 
of  approaching  current  duplication  problems,  and  one  which  does  not 
re  ire  any  new  agency  to  give  up  any  form  since  software  could  be 
written  to  produce  hard  copy  versions  of  current  forms  using  disk- 
stored  data.  The  feasibility  ot  microcomputer  data  collection  of  this 
sort  has  already  been  demonstrated  in  the  testing  area  (Vale,  1981). 

Fifth,  experience  in  many  studies  indicates  that  automated  data 
collection  techniques  can  be  used  to  collect  reliable  data  from 
unsophisticated  and/or  uncooperative  operators  (Johnson,  ^>er 

resistance  to  automated  information  collection  can  be  minimized  if 
human  factor  variables  are  considered  in  the  design  and  introduction 
of  the  software  system  (Johnson,  et  al.,  1981). 
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